Security Lefttovers
-
SANS ☛ Credential Guard and Kerberos delegation, (Mon, Dec 2nd)
The vast majority of red team exercises that I (and my team, of course) have been doing lately are assumed breach scenarios.
-
Lee Yingtong Li ☛ Investigating a proprietary Android 2FA system
This article concerns an Android app used as part of a proprietary two-factor authentication (2FA) system. Investigation of the app and 2FA protocol reveals some interesting design decisions.
Overview
The 2FA system is similar to well-known offerings such as Duo Security and Okta Verify. When a user initiates a request (e.g. log in request), a push notification is delivered to the 2FA device. The user can then approve or reject the request, and the outcome is directly transmitted to the server. Therefore, the 2FA system is an interactive online protocol requiring internet connectivity to function, rather than an offline protocol like TOTP or HOTP.
The developer of the 2FA system advertises that the system is superior to other 2FA protocols, due to the use of cryptographic features – described as a ‘signature’ – that enable the server to determine not only that the user has approved a request, but also to verify that the user has approved the specific details of that particular request. As we will see, there are some interesting hidden details behind this description.
QR code message signing
Like many similar 2FA apps, the app is initialised by the user scanning a QR code on their mobile device.
-
Scoop News Group ☛ Small number of vulnerabilities patched in last Android security update of 2024
None of the patched bugs were considered critical.
-
Bruce Schneier ☛ Details about the iOS Inactivity Reboot Feature
I recently wrote about the new iOS feature that forces an iPhone to reboot after it’s been inactive for a longish period of time.
Here are the technical details, discovered through reverse engineering. The feature triggers after seventy-two hours of inactivity, even it is remains connected to Wi-Fi.
-
Forbes ☛ Microsoft backdoored Windows Warning—Do Not Install This App On Your PC
Microsoft’s mission to push Chrome users to the Edge has made plenty of headlines. And it now seems that if it can’t convince users to switch browsers, switching search engines is the next best thing. Chrome is clearly less trouble if Bing is being used. That’s the implication behind the latest warning hitting Windows users around the world, as a Microsoft app is accused of secretly decrypting Chrome tracking cookies, installing Bing search, and of course driving users to switch to Edge.
-
Mobile Systems/Mobile Applications
-
Android Open Source Project ☛ Android Security Bulletin December 2024 | Android Open Source Project
The most severe of these issues is a high security vulnerability in the System component that could lead to remote code execution with no additional execution privileges needed. The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are turned off for development purposes or if successfully bypassed.
-