Which of the following statements on computer systems security are true

$$ Cookies security is well aligned with the SOP $($same origin policy$).$

$$ A new app in Android may request access to the camera of the mobile device even if it is not defined in its manifest.

$$ The cross$-$site request forgery $($CSRF$)$ attack is possible both with the GET request and with the POST request.

$$ Symbolic execution is well suited to finding deep bugs.

Which of the following statements on computer systems security are true

$$ An important threat model for mobile device is that attackers steals it and wants to read the data stored on it$,$ which the mobile the mobile device can be secure at just one assumption, that it is password protected

$$ erasure of data from mobile device can be effectively done by encrypting data and erasing the key securely

$$ important attack surface on modern mobile devices includes reading uid, bugs in operating systems or drivers

$$ In andriod there is no dedicated dependency management between application

$$ If attacker is able to gain control over mobile device secure enclave, the mobile device can still operate securely

Which of the following statements on computer systems security are true

$$ In mandatory Access control paradigm the security cannot be achieved when the code of the application is buggy

$$ Bugs are equivalent to exploit

$$ In secure web application clients cannot be identified by cookies

$$ The content Security Policy is an opt in security mechanism for web application which allow security related settings in special headers of web pages