meta user
network profile
| bio | website | andrewmichaelsmith.com |
|---|---|---|
| location | United Kingdom | |
| age | ||
| visits | member for | 2 years, 3 months |
| seen | May 20 at 9:33 | |
| stats | profile views | 53 |
Software Developer
|
Mar 28 |
comment |
What is zero day? Isn't this a grey area - we know buffer overflows exist but that doesn't discount every new buffer overflow because "oh, we know about buffer overflows already". So therefore should we be discounting a new SQL vulnerability in Jon's Cat Blog? It seems odd to refer to that as an 0day, however. |
|
Mar 18 |
comment |
How would one crack a weak but unknown encryption protocol? I'm possibly being a bit pedantic here but isn't it "as good as nothing" rather than being "worse than nothing"? |
|
Mar 8 |
comment |
What are the disadvantages of Tor? So you're proposing limiting SSH login to only allow it from Tor? I'm not quite sure how you'd implement that but even if it is possible what's the point? It would be far better/simpler to limit SSH login to your I.P address(es). Also, as anyone can use Tor you're not really restricting people from accessing it - just obscuring it a little |
|
Jan 21 |
comment |
How unlikely is it that a Google Doc link is guessed? And not forgetting the link hanging around in someone's browser history |
|
Jan 15 |
comment |
How can I tell whether this computer is part of a botnet? If it's a virus it's a very poorly written one! Is it possible that someone has installed some legitimate software that has these as dependencies? It sounds like unxutils.sourceforge.net. It's possible there are some programs out there that needs these installed |
|
Jan 10 |
comment |
Why do some antivirus programs find infections that others miss? @illsecure don't do this! VirusTotal is a great tool but anti-virus tools do more than just scan executables (such as use of heuristics). See prevx.com/blog/106/… for more information. |
|
Dec 11 |
comment |
Banking application login leaks information "If the username exists then show image" - I think here you've made an assumption that I have personally never seen. Usually it is the case that "if the username and password is correct then show image" |
|
Nov 16 |
comment |
What XSS attacks doesn't “Reflective XSS Protection” defeat? So what I guess what I'm really interested to know is are there any evasion techniques that mean that by design reflective XSS protection won't work? Is it just going to be a game of catch up forever or has someone found a really tricky evasion mechanism that webkit could not block for x reason |
|
Nov 16 |
comment |
What XSS attacks doesn't “Reflective XSS Protection” defeat? So are there any examples of such bypasses? Is there such a bypass that for some technical reason cannot be blocked? Or can all be eventually blocked? |
|
Nov 16 |
comment |
What XSS attacks doesn't “Reflective XSS Protection” defeat? And of course I have notified the owner of the website of the issue! :) |
|
Nov 1 |
comment |
Use HTTP POST for Google Search queries For this specific question using a POST request is pointless but there are cases where it improves security. GET URLs are kept in the browsers history and may be obtained at a later date. Obviously with a search query this makes no different - the history will contain the resulting page which will also contain the query. But in the case of credit card data (for example) this should stay in the POST request, even on HTTPS! |
|
Nov 1 |
comment |
Is it necessary to scan users' file uploads by antivirus? I agree that anti-virus is over kill but perhaps running some kind of normalization on the data before passing it to the parser might reduce risk. |
|
Oct 13 |
comment |
I stupidly responded to an email from a hacker posing as a friend Sounds like you're fine - the only thing I can see happening from this is your email address being starred as someone to phish again :). Keep your passwords different and complicated, you'll be fine. |
|
Oct 12 |
comment |
I stupidly responded to an email from a hacker posing as a friend What information did you provide to the phisher? |
|
Oct 12 |
comment |
Profiling hackers with keystroke dynamics Kippo is probably good for this - which I see you are already using! It's probably difficult to get people running honeynets to give you all their data (though someone on here may prove me wrong!) but you may have a better shot asking them to run your analysis tool over their data and send you the (anonymised) results. |
|
Oct 11 |
comment |
Privacy issues in Peer to Peer networks @pnp For example, torrent clients. Wilfully provided - most torrent clients will identify their version and even their platform (wiki.theory.org/BitTorrentSpecification discussed client version being encoded in peer_id). Data leakage - any vulnerability in a piece of p2p software, more recent example that comes to mind is the remote exploit in utorrent - torrentfreak.com/utorrent-vulnerable-to-remote-exploits |
|
Oct 11 |
comment |
How do I secure patient data cheaply in a small doctor's office? Unplug your systems from the internet, if you can |
|
Oct 10 |
comment |
E-mail read receipt through XSS It's not XSS - it's just HTML. And it is blocked - by default by gmail and many providers - but you can unblock it (by pushing "Show pictures in this email") |
|
Oct 5 |
comment |
Port scanning legal or not? interesting discussion: nmap.org/book/legal-issues.html |
|
Oct 5 |
comment |
How does Amazon bill me wihout the CVC / CVV / CVV2? CVC isn't required though often payment handlers will give you a discount for using CVC so quite a lot of people choose to do it, there are also the fraud benefits mentioned below. It might be worth noting that here in the UK I have to use CVC for Amazon - it's possible that they're doing some risk assessment and allowing no-CVC if they deem you less risky enough. |
