353 reputation
18
bio website linkedin.com/pub/…
location Oakton, VA, USA
age
visits member for 3 years, 11 months
seen Oct 2 at 12:36

Jun
4
comment Client-side attacks with custom malware in penetration tests
You might also add 'restrictions' to your malware 'just in case' (eg for example you share the code with someone else who wants to do similar). The restrictions should probably be both in time (eg first line of program could be return out of program if date is greater then x) and space (if machine not on this net or isn't in this list of hostname, then exit). It could be argued this is unnecessary but if nothing else it helps with peace of mind. If you do share the code it also helps make clear it's not for general use.
May
8
awarded  Informed
Mar
25
answered I managed to capture a botnet control host, what do I do with it?
Mar
21
asked Spike in TCP port 5904 activity - what for?
Mar
15
revised Is there multi-factor authentication for machines?
added 686 characters in body
Mar
14
asked Is there multi-factor authentication for machines?
Feb
8
comment how to mitigate a DDoS from botnet on your website that comes from random IPs
Besides being upstream of the bandwidth chokepoint, the other advantage of the carrier services include: (1) they have a preestablished blacklist from analyzing the bots and controllers across their entire network (and pay for threat intel services), (2) they can 'afford' fancier detection and scrubbing algorithms because it's a shared service
Jan
31
answered Are there any known botnets targetting smartphones?
Jan
28
comment How to treat non-optional bad security questions?
True. And none of this will beat a keylogger. Multi-factor is really what should be used for any reasonable degree of trust.
Jan
28
revised How to treat non-optional bad security questions?
added 7 characters in body
Jan
28
answered How to treat non-optional bad security questions?
Jan
22
revised Single vs multiple personas? What are the security implications?
added 212 characters in body
Jan
10
comment What defines a 'defense contractor' and what is required to be reported in new US law?
@Ramhound "then you already know you might be affected" - I'm guessing you don't have much dealing with DoD if you think a law will make from passing thru DoD process, to affected contractors, thru the contracting office, and to affected employees, all in less than a month. :-) I was asking here since the 'buzz' generally is faster than the official channels since here the i's don't need dotting. I'm not asking if I'm affected - I'm asking wrt affect on community.
Jan
10
revised What defines a 'defense contractor' and what is required to be reported in new US law?
added 947 characters in body
Jan
10
awarded  Commentator
Jan
10
comment What defines a 'defense contractor' and what is required to be reported in new US law?
@Ramhound - does your comment mean that who is affected and what they need to report is 'need to know' and the general public is not allowed to know?
Jan
9
asked What defines a 'defense contractor' and what is required to be reported in new US law?
Jan
2
answered How similar are bots regarding their HTTP GET request?
Dec
19
awarded  Yearling
Dec
15
comment Single vs multiple personas? What are the security implications?
@D.W. - wrt 'can you say anything about any reasons you may have to expect there would be a security impact' - it seems to me more identities increases the chance of compromise while decreasing the risk of any given compromise. It also increases complexity (the bane of security, particularly where humans are involved) from the individual's viewpoint (more to keep track of) while potentially decreasing it from other's viewpoints (they get just the piece of the person they care about). It also raises the person vs persona vs identity issue which have subtle security differences.