I keep hearing about the XML round trip vulnerability in version 3.2.4 of the Ruby package REXML. I looked into it myself, of course, and it seems to have something to do with parsing an XML document, then putting it back into XML again, a…
Does Wire employ encryption of data at rest?
I generally consider Signal and Wire to be the best tools today for sending information privately between two parties. Both meet the marks on crypto, open-source, 3rd party audits, PFS via the d…
I have some questions about certificate pinning.
Supposing that a mobile application has pinned only the root CA, it should be possible to an attacker to redirect in some way the victim to a malicious website with the same Root CA. Am I wr…
I am about to return my ThinkPad laptop to my (former) employer. I found a very nice solution to erase / protect my private data — ThinkWipe application in ThinkPad’s BIOS. I made use of it right away.
However, to my kind of big surprise,…
I’m trying to verify GameCenter authentication on an iOS app with GameKit. The fetchItems API returns a URL for the public key needed to do this.
Steps 3 and 4 of that API say:
Use the publicKeyURL on the third-party server to download t…
I’ve been fumbling through the world of Information Security by going through the HTB challenges, and I’ve come across an issue I just can’t seem to find an answer for. During one of the challenges I’m trying to crack a zip password using …
Posted by Krish Vitaldevara, Director of Product Management Trust & Safety, Google PlayProviding safe experiences to billions of users and millions of Android developers has been one of the highest priorities for Google Play for many y…
I am trying to delete a certificate and it’s private key using certutil -csp "Microsoft Enhanced Cryptographic Provider v1.0" -delkey "the key container". This gave me a command completed successfully message. I then ch…
I’m trying to recreate a Watering hole SMB theft attack where you send a victim a link to your website containing code like file://ip/file.gif.
Causing forced authentication which passes the NTLM hash.
I have the code which executes the pr…
I have worked on many API integrations scenarios and I used 2 approaches to authenticate the API calls:
Using API Keys
For example inside Hubspot integration I use this web call to get all the accounts using API Key:
https://api.hubapi.c…
