30,419 reputation
23277
bio website
location Troy, NY
age 30
visits member for 2 years, 2 months
seen 4 hours ago

May
29
reviewed Leave Open Are there any reasonable TrueCrypt forks?
May
29
reviewed Close How to determine what type of encryption has been used?
May
28
comment Which mechanism did Flame use to avoid being identified?
@yzT - see the first part of my answer. It does nothing on most systems, that is something in the code that makes it hard to detect. The only way to initially recognize malware is if it does something. Otherwise, it can quite comfortably sit in the background without being easily noticed. I don't think it was particularly hard to recognize compared to anything else after it was detected (by a person).
May
28
comment Secure end-to-end when part of conversation must be over HTTP
@CupawnTae - I think you are going to have to add more details in general to the question. As it is currently stated, I don't see a clear solution. You have an untrusted connection from the user to the network provider that you have no control over, so you can't detect tampering, period. There is nothing you can really do to deal with that since you can't guarantee anything about who is actually talking to the network provider unless there is some undisclosed mechanism they use to authenticate the user.
May
28
revised Can a 'fingerprint' file be used to track a stolen device?
added 564 characters in body
May
28
reviewed Looks OK Buffer Overflow Exploit Shellcode for Windows
May
28
answered Can a 'fingerprint' file be used to track a stolen device?
May
28
answered Which mechanism did Flame use to avoid being identified?
May
28
answered Secure end-to-end when part of conversation must be over HTTP
May
28
answered Trace source and destination of an SMS message
May
23
answered What's to stop someone from 3D print cloning a key?
May
23
reviewed Close Bluetooth Peripheral Vulnerabilities
May
22
revised How does forensic software detect deleted files
added 51 characters in body
May
22
reviewed Approve suggested edit on Simple way to protect ssh against man-in-the-middle attack?
May
22
revised How does forensic software detect deleted files
added 292 characters in body
May
22
revised How does forensic software detect deleted files
added 654 characters in body
May
22
comment How does forensic software detect deleted files
@MatthewPeters - right, the only way to be sure is to actually destroy the data. It might be enough, but there may be something in the file format (or it may have simply used a contiguous block) that may let it be recovered still. Getting rid of the pointers MAY prevent recovery, but it just as likely (if not more likely) may not.
May
22
comment How does forensic software detect deleted files
@user46850 - not necessarily. Some file systems also put forward or forward and reverse pointers at the beginning of each block of clusters used. It depends on the file system. It also depends on the file format and if there is anything that will help piece clusters together even if they aren't linked to each other.
May
22
comment How does forensic software detect deleted files
I forget if it is the MFT or actually at the end of each cluster, but yes, there is a linked list that ties the clusters used in a file together in many file systems. The exact mechanisms vary by file system.
May
22
answered How does forensic software detect deleted files