Information Security Stack Exchange Newsletter – Thursday, February 2, 2023

Top new questions this week:

The rationale behind allowing `sudo -u root` but disallowing `sudo -u <any other user>`

I’m working with a customer where I use a functional user ID, created specifically for the purpose, to install and configure some software on multiple servers. The customer’s security policies, …

sudo

asked by mustaccio Score of 4 answered by fleitner Score of 9

Can an Intermediate CA extend its “Certificate Key Usage” by issuing a new certificate for itself?

I’m trying to understand the purpose of defining self-issued certificate concept in RFC5280 (Internet X509 PKI Certificate and CRL Profile): Regarding this concept the RFC states: This specification …

certificates public-key-infrastructure certificate-authority

asked by Ebrahim Ghasemi Score of 2 answered by bartonjs Score of 1

Git Remote Code Execution vulnerabilities as of January 17, 2023

GitHub Blog: github.blog/2023-01-17-git-security-vulnerabilities-announced-2 Git has 3 new Remote Code Execution vulnerabilities. It’s said in the blog that Git was already patched by version …

git github

asked by Leandro Gecozo Score of 2 answered by Ángel Score of 1

Patterns in passwords

I am posting to ask about two conflicting password recommendations. I know only bits and pieces about cryptography. Let me begin by checking a basic assumption: in a cracking attempt, a string is …

passwords password-strength

asked by anon Score of 1 answered by mentallurg Score of 1

How can I sandbox wine itself, and all wine applications?

I don’t want wine accessing my ext4 partition which is typically the Z: drive. How can I restrict or sandbox wine?

linux sandbox restrictions

asked by Aarav Prasad Score of 1

Does defining “a minimum path length” for certification validation have any security benefit?

As you may know, Common Criteria (AKA ISO/IEC15408: A standard for IT Security Evaluation) have provided some security base-line documents named “Protection Profile” for software developers …

certificates public-key-infrastructure certificate-authority common-criteria

asked by Ebrahim Ghasemi Score of 1 answered by Gilles 'SO- stop being evil' Score of 1

How do I best share a shared account's private key?

I made a website which among other things allows users to sign up to events. The HTML form is filled out and submitted, which automatically updates a google spreadsheet with all applications. This of …

key-management oauth websites

asked by RattatAndyGo Score of 1 answered by CBHacking Score of 1

Greatest hits from previous weeks:

How does Google Authenticator work?

Google Authenticator is an alternative to SMS for 2Step verification, installing an app on Android where the codes will be sent. It works without any connectivity; it even works on plane mode. This …

authentication passwords cryptography google one-time-password

asked by The Illusive Man Score of 264 answered by Arjun Sunil Kumar Score of 62

How does hashing work?

I have been interested in Information Security. I was recently introduced to the idea of hashing. What I currently understand about hashing is that it takes the password a user enters. Then it …

hash

asked by Griffin Nowak Score of 81

Can an employer see what I'm doing on my iPhone whilst logged onto wifi

I log on to my works wifi throughout the the day whilst at work, I use apps like WhatsApp and iMessages to communicate when I need to, can my employer see the content of those messages (actually read …

wifi

asked by Caroline Score of 19 answered by March Ho Score of 28

Can Android phone running without SIM card be tracked (localized) by police?

I am running an Android phone without a SIM card. I am using it for web surfing. Can the police localize my phone using the cell towers (BTS)? In other words, I know Android phones emit radiations …

android phone

asked by yasserbn Score of 32 answered by Gilles 'SO- stop being evil' Score of 32

How to verify the checksum of a downloaded file (pgp, sha, etc.)?

Maybe I have been negligent towards the verification of software I download over the Internet, but I (or anybody I ever met) have never tried to verify the checksum of the contents I download. And …

hash man-in-the-middle integrity

asked by ThankYouSRT Score of 52 answered by Connor J Score of 61

Unknown MAC address connected to router

I found an unknown MAC address connected to my home router. How would I figure out what OS the IP or MAC address is running?

network network-scanners

asked by Sean Score of 12 answered by Rory Alsop Score of 13

I found that the company I work for is putting a backdoor into mobile phones

I have found out recently that the remote assistant software that we put in a smartphone we sell can be activated by us without user approval. We are not using this option, and it is probably there …

disclosure ethics backdoor

asked by anonymousquery Score of 366 answered by Oleksi Score of 320

Can you answer these questions?

Is my Jupyter notebook on EC2 secure?

I have a product I am making available to some users that runs via a Jupyter notebook. I deploy Jupyter inside of a docker container to an EC2 host. Each user gets an instance I’ll send to them. For …

python aws

asked by achyrd Score of 1 answered by Bubble Hacker Score of 0

Can you decrypt storage from an Android phone directly from the flash?

I have an old phone that I am trying to recover the data from. I was hoping to desolder the chip and buy an expensive reader for NAND flash chips but then it occurred to me that the contents of the …

android decryption smartphone

asked by yemista Score of 1

MMLS (Sleuth Kit) not working in some situations

I am experiencing some issues when using mmls command after having created an image with dcfldd/guymager in some particular situations. Usually this approach seems to be working fine to create …

forensics backup disk-image

asked by Luca Domeneghetti Score of 1