hsnm

605 reputation

bio	website
	location
	age
visits	member for	7 months
	seen	Apr 14 at 2:52
stats	profile views	7

I'm a computer security researcher. I have programming skills in C/C++, Java, Objective-C and PHP.

	605 reputation	bio	website		visits	member for	7 months
36 badges		location			seen	Apr 14 at 2:52

summary answers questions tags badges favorites bounties reputation activity

32 Actions

suggestions reviews revisions comments badges posts accepts all

Feb 13	comment	How to store a private RSA key for an application? Depending on the platform, you might have some secure key storage protected by the operating system. Something like Keystore.
Nov 10	awarded	Favorite Question
Nov 9	comment	Attacking an office printer? @Polynomial I feel like even if the printer is not accessible outside the network, it's still an attack vector on the network. It could enable more opportunities if you launch a multi-hop attack by going through the printer. For example, an attacker can bring in a laptop and connect to the wireless network (if there is any) and then get to other places through the printer.
Nov 8	awarded	Notable Question
Nov 8	comment	Does a 'reset password' website facility give away too much information? Well.. if you have some sort of an account number, you can ask the user to enter that to retrieve the password.
Nov 8	comment	Attacking an office printer? @mikebabcock what kind of problems are you facing with wireless printers?
Nov 7	comment	Attacking an office printer? @mikebabcock the problem is to identify which is legitimate traffic?
Nov 7	awarded	Popular Question
Nov 6	comment	Attacking an office printer? true.. but additional cost and maintenance overhead.
Nov 6	awarded	Good Question
Nov 6	awarded	Nice Question
Nov 6	awarded	Commentator
Nov 6	comment	Attacking an office printer? Very comprehensive answer. I'll read this carefully and see what's possible on my side. I like the fact that these are possibly using very old kernels with enough security holes to give remote privilege escalation and easily launch a tunneling attack.
Nov 6	comment	Attacking an office printer? @GrahamHill I have no answer this and I'm surprised. This printer is managed by some other admins. I'm auditing the security of the network and haven't talked to them yet.
Nov 6	accepted	Attacking an office printer?
Nov 6	comment	Attacking an office printer? Thanks for the answer. What you describe is good for an attacker who wants to misuse the printer itself. I'm in particular interested to see how an attacker can use the printer as a hop to attack other machines. This is very important at this point.
Nov 6	comment	Attacking an office printer? @Polynomial I'm scared about this. I have been trying to search around but couldn't find many useful info. I need to check how much my printer is capable to do to see if a relatively dangerous attack can succeed. I haven't been able to find much info about the OS or hardware specs for my printer. Will it allow for some privilege escalation? Is it running CUPS for ipp? I have no idea yet.
Nov 6	asked	Attacking an office printer?
Oct 25	asked	Why not buy cheap SSL certificates?
Oct 22	comment	Experience with a recent DDoS attack on Apache Yes I see the difficulty in DDoS problem when the traffic cannot be easily distinguished. Probably pattern recognition or anomaly detection tools will have a hard time. I think the best way to go is to design the system such that the attacks don't at least completely interrupt the service. Maybe having multiple servers with a load balancer can help.