679 reputation
49
bio website
location
age
visits member for 1 year, 6 months
seen Mar 16 at 7:01

I'm a computer security researcher. I have programming skills in C/C++, Java, Objective-C and PHP.


Nov
6
comment Attacking an office printer?
@Polynomial I'm scared about this. I have been trying to search around but couldn't find many useful info. I need to check how much my printer is capable to do to see if a relatively dangerous attack can succeed. I haven't been able to find much info about the OS or hardware specs for my printer. Will it allow for some privilege escalation? Is it running CUPS for ipp? I have no idea yet.
Nov
6
asked Attacking an office printer?
Oct
25
asked Why not buy cheap SSL certificates?
Oct
22
comment Experience with a recent DDoS attack on Apache
Yes I see the difficulty in DDoS problem when the traffic cannot be easily distinguished. Probably pattern recognition or anomaly detection tools will have a hard time. I think the best way to go is to design the system such that the attacks don't at least completely interrupt the service. Maybe having multiple servers with a load balancer can help.
Oct
22
comment Experience with a recent DDoS attack on Apache
@Polynomial in general I don't like the idea of sending my traffic to a third party for analysis and mitigation, though it's a nice feature.
Oct
22
asked Experience with a recent DDoS attack on Apache
Oct
6
answered Security Assessment vs. Risk Analysis
Oct
2
awarded  Supporter
Oct
2
comment How a malware executes remote payload
OK. So looks like utilizing mmap to load executable in a new process memory and executing it, without being detected on the file system or in the exec system call. Interesting one.
Oct
2
awarded  Scholar
Oct
2
awarded  Student
Oct
1
comment How a malware executes remote payload
I'm also adding dynamic class loading when the code is written in a language like Java. Using ClassLoader, the payload is retrieved over the network (and possibly stored as a class file) and then runs in the Java runtime environment.
Oct
1
comment How a malware executes remote payload
Yes right, I forgot this one. Passing it to an interpreter could be in many ways, through a pipe, calling the interpreter by invoking the shell using system(...), and perhaps by calling a shared library and feeding the code.
Oct
1
comment How a malware executes remote payload
So, given your list + fexecve(), we can summarize it by either opening a file, creating a pipe (also sort of a file), and loading the payload in an executable memory region.
Oct
1
accepted How a malware executes remote payload
Oct
1
asked How a malware executes remote payload