9,089 reputation
12843
bio website
location
age
visits member for 4 years, 7 months
seen 7 hours ago

Jun
15
comment Android wear, Tizen Encryption
@ pqsk : Thank you. Here also is a better analysis on Android Wear -- labs.mwrinfosecurity.com/blog/2015/05/22/…
Jun
15
comment Android wear, Tizen Encryption
To roughly summarize, Wear and Tizen don't do any full-disk encryption, so encryption must be provided by the app, preferably at the transport layer to a TLS-based service (and then stored securely on a server). Three Wear devices can currently be rooted, and as such, strace, gdb, and other memory-dumping, hooking, and software/process tracing/debugging tools can be leveraged to read data at the system-call, kernel, or other userspace layer. Libraries can be shimmed and methods/functions can be clobbered.
Jun
15
comment Android wear, Tizen Encryption
Well, I can't answer until someone reopens this question but check out these resources in the meantime -- conference.hitb.org/hitbsecconf2015ams/materials/Whitepapers/… -- conference.hitb.org/hitbsecconf2015ams/materials/…
Jun
15
comment Android wear, Tizen Encryption
@ pqsk : Ok great, that's what I thought but glad you clarified. Now on to an answer!
Jun
15
comment Automated tools for applying formal methods to verify security policy in existing software
@ Steve DL: added clarity, thank you for the feedback
Jun
15
comment Automated tools for applying formal methods to verify security policy in existing software
there is also langsec.org
Jun
14
comment Android wear, Tizen Encryption
Someone please do a writeup of this article -- androidguys.com/2015/06/14/…
Jun
13
comment IPhone iOS 8.3 encryption security against physical access
The iPhone 4 can't run iOS 8, only iOS 7. Is this rhetorical or do you mean the iPhone 4S? Let me change this around -- let's assume iPhone 5S, which contains the Secure Enclave. In this case, some data (non-iOS-dpapi) is recoverable except when the phone is off --or-- if the phone has just booted and no PIN/passphrase has yet been entered. An MDM certificate on the phone could also be used for full data recovery. More info here -- darthnull.org/2014/10/06/ios-encryption
Jun
4
comment explanation of an nmap behaviour
My first guess is that the host is not ICMP reachable, nor does it run TCP ports 80 or 443, thus the host is skipped due to a lack of the -Pn flag. My second guess is that the parallelism and/or scan-delay defaults of T3 timing aren't sufficiently picking up the port, so try -T2 --scan-delay 1s, -T1, or even -T0
May
22
comment Any way to circumvent a 'filtered' response on NMap?
Repeat question -- security.stackexchange.com/questions/53104/…
May
20
comment Resources on security risks of NFC
Also see this question -- security.stackexchange.com/q/66590/140
May
20
comment How secure is NFC on mobile devices?
Also see -- security.stackexchange.com/q/66590/140
May
17
comment How to detect Meterpreter and similar malware?
Actually it appears that Avast, BitDefender, and BullGuard are the only three that can reliably detect Meterpreter. In particular, McAfee and TrendMicro will not even catch a Meterpreter which has not been obfuscated at all! What the heck!
May
13
comment What techniques and tools do you use to relate security events?
It's Q2-2015 and most of these answers are still relevant, seeing shops running RSA Security Analytics, Splunk, and OSSIM, as well as QRadar and certainly ArcSight and Trustwave. What I don't see are modernized additions such as Cybersponse, Squrrl, etc. Please speak up!
May
13
comment What is the proper priority/mix of (people, tools and technology, processes) to optimize defense?
Is this a goal of the NIST CSF? Does it try to answer this qustion? If so, how effectively? What is missing?
May
13
comment Should veil framework produce packed and obfuscated binaries which bypass virustotal?
@ Steve : Unsure, but you are saying too much and I am purposefully implying too little. Concentrate on the best approach, which is what I gave
May
13
comment Should veil framework produce packed and obfuscated binaries which bypass virustotal?
@ Steve: Great question. So the basic answer is that you're fighting yourself: by submitting it, you're telling the AV companies that it's malware too simply since many factors will catch it. Check out the Malware Analyst's Cookbook or its tools here -- code.google.com/p/malwarecookbook -- there are many other resources but this is an ok starter
May
12
comment Can I use Metasploit to demo penetration testong on Zigbee or Smart meter?
You must be thinking of Killerbee -- code.google.com/p/killerbee/wiki/GettingStarted
May
12
comment NFC contactless payment security
More links to read -- inforisktoday.com/blogs/… -- hackfu.mwrinfosecurity.com/hackfu-blog/params/post/465447/…
May
8
comment Is it safe to trust a Docker container?
infoq.com/news/2015/05/Docker-Security-Benchmark