28,935 reputation
23072
bio website
location Troy, NY
age 30
visits member for 2 years, 1 month
seen 9 hours ago

Jul
28
comment Drive-by download attacks: What can cause the file to be downloaded without interaction?
I'll repeat what Graham Hill pointed out, but add to it a bit. This question makes absolutely no sense at all. In both cases described in the article, you are not trying to download anything. The first case is talking about a malformed advertisement (often full screen over the content you are trying to access) that results in execution where it fools the browser in to thinking the click was a download verification, the other uses the website loading itself without any click being necessary at all.
Jul
27
comment Does a virus need to be clicked on to function?
@JamesSnell if it is in metasploit that alone would counter my question, assuming it allows arbitrary execution.
Jul
25
comment Single sign on - is this a secure way to log in?
Oh, I see, I misread your post. I'll update my answer momentarily.
Jul
25
comment Does a virus need to be clicked on to function?
@JamesSnell - If you read my post, I indicate that. It is, however, quite rare for a virus to hook automated processes if it is not brought on to the system through the intended vector. Most viruses are actively delivered. Unless things have changed a lot since I last looked, effective passive delivery is so rare, that while worth a mention and still a good reason to use a VM, the chances are just about as good of a virus designed to escape a VM as one that will hook a system scan or thumbnail viewer or something similar, especially if you disassociate it from it's normal extension.
Jul
24
comment Does a virus need to be clicked on to function?
@emodendroket - yeah, that was grouped in with "There is a very slim possibility it might be able to abuse some system process." Search indexing, virus scanning itself, other things like that could potentially have issues, but that kind of a vulnerability is pretty rare and being meaningfully exploitable is even more rare since you have to end up evaluating data in such a way that the evaluation of the data can result in a hijacking of the process.
Jul
24
comment Does a virus need to be clicked on to function?
@Ajedi32 - XSS is a major vector for injecting such malicious JavaScript though, if you can prevent that, then the instances of drive by malware goes down significantly. Preventing malware download is one of the main goals of the project. The main point I was getting at was simply that not all Javascript is dangerous, only particular parts. If you can avoid those part, then you are far safer, that can be done by either the client or the server or both as long as the server itself is actually trust worthy.
Jul
24
comment Does a virus need to be clicked on to function?
@loneboat - mostly by using a separate system. I personally haven't looked in to it that much, but there are projects like Caja Project working on subsets of Javascript that are more secure. I'm not sure if there are any browsers that can currently limit execution to that though.
Jul
24
comment Does a virus need to be clicked on to function?
@PlasmaHH - that's a fair point, there might be a small chance. Those were still more likely bugs that resulted in crashing though. It would be rather hard, if even possible, to hook such a behavior in to causing a code execution, but it might not be impossible. I'd still say it is pretty unlikely, especially for any run of the mill virus. An active infection approach is far more likely.
Jul
24
comment Security sanity check
@PwdRsch - well, technically it would be a violation, but a QSA is likely not going to catch it. You can fill out the QSA saying it is secure if you believe it is, but any competent audit would reveal that it is not secure and thus fail PCI-DSS. But yeah, it wouldn't surprise me at all if they claimed it was PCI compliant on their self assessment.
Jul
23
comment Someone borrowed my phone and Im scared its hacked
possible duplicate of If someone asks to borrow your phone to make a call, what could they do?
Jul
18
comment How to identify an encryption algorithm
If you are trying to identify an algorithm based on its actual behavior, you may want to try Cryptography.SE. I'm not sure if it is a good fit there or not, but it is more likely to fit there than here.
Jul
17
comment How can my .exe become infected?
@esqew - fair point, that was the first one that came to mind, but there are many other similar options. I'd welcome a suggestion for a better example to use.
Jul
10
comment How can Joe Citizen report or at least hamper a phone-based PC scammer?
Some system admins I know decided to have fun with them and kept "going to look for things" and kept them on hold for a few hours while they kept working until they got bored. Personally, I always like to tell them it says "C:\" in the lower right corner of my screen. They always get confused. It is worth noting though, most of the people actually making the calls seem to think they actually work for Microsoft. So they may not know they are working for a scammer.
Jul
9
comment Software for web hacking?
You can do SQL injection and XSS with any browser, you don't need special software. Beyond that, this question is far too broad.
Jul
8
comment Mobile Backend Server: How to validate authenticated client is valid?
you generally can't trust the client for authentication, though a local client may be able to have the server generate a token without additional user interaction. I'd personally probably skip the local authentication step and/or do them both simultaneously though. It's hard to say without knowing more about what your app needs to be able to do though. Big thing is you can't trust the client directly though, only Facebook or Google's server can tell you who the user is, even if that is via something that they give the client to give to you.
Jul
8
comment Mobile Backend Server: How to validate authenticated client is valid?
Look in to oAuth, it is covered pretty heavily here already. It covers how to handle authenticating a user against something like Google or Facebook.
Jul
2
comment Custom surveillance protection
@AlexH - no one has yet broken my /dev/null encrypted volume. Unfortunately, I seem to have trouble reading anything back from it.
Jul
2
comment When do governments allow export of cryptography software?
There is a HUGE difference between having a copy of the algorithm and understanding the math behind why it works. Cryptography is generally one or more graduate level course and has prereqs in various advanced discreet math concepts. It is very non-trivial.
Jul
2
comment When do governments allow export of cryptography software?
@HRJ - that is why they have to get a license exception. The review looks at how the software can be used to make sure it fits the use case. You couldn't export code that was designed to work with military radios because it would fail to pass the export checks. You can export something for letting smartphones send encrypted text messages. If some enemy nation wants to have their soldiers sending secure text messages, they can grab the software and make use of it, but without someone familiar with the encryption, it will be slightly harder to re-purpose the algorithm for a secure radio.
Jul
2
comment When do governments allow export of cryptography software?
@AndrewHoffman - the export controls don't really have much in the way of effective teeth, but they do effectively control what US trained cryptographers can do and where they can work if they plan on coming back to the US or a country that extradites to the US. Much of the concern is not so much enemies of the US getting the software as it is learning to understand how and why the technology is implemented the way it is so that they could make their own derivative work. still probably not particularly effective, but since when does that stop the government?