607 reputation
1310
bio website
location
age
visits member for 2 years, 3 months
seen 3 hours ago

Jul
27
comment Does a virus need to be clicked on to function?
@JamesSnell Cool. Glad you didn't take my comment the wrong way :)
Jul
27
comment Does a virus need to be clicked on to function?
I would agree with almost all of your post - but a sufficiently pedantic reader would haggle on the definition of 'virus' you (and all the other answers!) use. Strictly speaking, your answer assumes the OP meant 'virus' to include 'worm' - likely a safe assumption, but I thought it worth pointing out. While I have no solid definitions, Wikipedia's article on 'Computer Virus' seems to use the definition that a 'virus' will self-replicate and a 'worm' will 'replicate', often 'relying on security failures'. Again, not trying to be an ass here! :)
Jul
1
answered BIOS upgrade only with PGP-signature / encrypting the whole BIOS
Jun
27
awarded  Yearling
May
24
comment Where can I find a list of checksums for windows files? Why don't MS sign all their executables?
Ah, I didn't know that Windows used file deltas as you describe. That complicates things somewhat, but you could still generate all possible file combinations and just provide a (possibly somewhat large) number of checksums. That could be the reason MS don't sign so many executables.. hrm.
May
23
comment Where can I find a list of checksums for windows files? Why don't MS sign all their executables?
@schroeder - Yes, checksums would need to be supplied for updates also.
May
23
awarded  Commentator
May
23
comment Where can I find a list of checksums for windows files? Why don't MS sign all their executables?
@Steve - I mean the windows PE signatures that the kernel uses to load modules. I know they aren't present in that format because I can't verify them.
May
22
asked Where can I find a list of checksums for windows files? Why don't MS sign all their executables?
Mar
26
comment Using pattern matching to make a port more secure
Something like this en.wikipedia.org/wiki/Port_knocking? Or are you trying to fingerprint browsers, a la detectright.com ?
Mar
24
answered Is compiling source code from github a big security risk?
Mar
22
answered Outbound DDOS attack from a centos server
Mar
21
answered What are reasons why one shouldn't run Tor at a network level?
Mar
21
comment How can you prevent employees of your company from creating valid ssl certs?
I'm adamant I recall a reasonably high-profile occurance of something similar a few years ago - a webmail service, perhaps hotmail or the ilk. I can't find any reference to it from a cursory google, though. I seem to recall the attacker simply registered an 'admin-sounding' username - "postmaster@hotmail.com" or something - and simply got an SSL cert emailed to it.
Nov
21
awarded  Scholar
Nov
21
accepted Where to publish security research?
Nov
20
awarded  Student
Nov
19
asked Where to publish security research?
Jul
14
awarded  Nice Answer
Jun
27
awarded  Yearling