1,574 reputation
212
bio website
location Tulsa, OK
age
visits member for 2 years, 4 months
seen yesterday

15 years enterprise IT / Infosec experience and counting...


Mar
24
answered Could an attacker prevent IIS from logging requests
Mar
23
comment Is Clickjacking a real security vulnerability?
One can also log keystrokes via an iframe if framebusting techniques are used.
Mar
22
comment Confused about SSL certificates needed for Windows proxy
I'm confused about why you need a web application proxy? If your goal is to redirect users on port 80 to port 443, a web application proxy is not required for that?
Mar
22
comment Which is first job or certificates
Just an FYI, you're not qualified to take the CISSP exam. You must have a minimum of five years of direct full-time security work experience in two or more of the 10 domains. For all requirements, please review: isc2.org/cissp-professional-experience.aspx
Mar
19
answered Is there any way to check the certificates in a client's root CA store?
Mar
19
awarded  Citizen Patrol
Mar
18
comment Does this image contain secret data?
File seems fishy to me. At best it's bad practice (SEO / Webmaster wise) to have a >3mb file size for a 16x16 icon.
Mar
12
comment In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?
It used to be quite common actually to utilize lower grade encryption in mobile or battery powered hardware to reduce CPU cycles and battery consumption. For example, the NintendoDS supported 64bit WEP only for those reasons.
Mar
11
comment proxy servers and restricted work computers
This may or may not work depending upon the OP's employer's VPN solution - at least I haven't had much luck establishing a network level VPN connection inside of a VPN connection.
Mar
10
revised What would you call an attack where authenticated user modifies other users information on web app?
added the actual attack name.
Mar
10
answered What would you call an attack where authenticated user modifies other users information on web app?
Mar
5
comment Is plain text over https really a good idea?
POST payload is not logged in the Webserver logs.
Mar
3
comment List of cookie parameter names to identify load balancing mechanism
A10 loadbalancers use a "sto-id" cookie by default, though the administrator can technically name the cookie whatever they want.
Mar
3
answered Why some routers ask for PIN but can't be cracked using PIN-based attacks?
Feb
4
comment Is there a “security fail forum / website” with lessons learned?
FailyMonster on Twitter reports on these type of incidents. twitter.com/failymonster
Jan
30
comment Check SSLv3 in Apache Tomcat locally as well as on server on windows/linux
Also keep in mind if your webserver is behind a load balancer that is offloading/inspecting/handling SSL traffic it may be vulnerable.
Jan
29
comment Could someone stop another from accessing their own online account?
I think you meant to say, how would Bob defend himself if Alice had a small team. ;) The best way to mitigate this attack if there is a small team willing to enter captchas would be to enable 2 factor authentication for the account. It's actually very easy to configure and use, and would prevent all the scenarios outlined above from being successful.
Jan
28
comment Someone or something tried to login to my Gmail using IP address of my shared hosting
You can also go to myaccount.google.com From there you can review "Devices" under "Recent Activity". Also, check under "Account Permissions" for "Connected apps and services".
Jan
28
answered Could someone stop another from accessing their own online account?
Jan
26
comment SSL mismatch error using ISP-provided IP address but not VPN IP address
Occam's Razor would suggest that Firefox is warning you that autos.yahoo.com is susceptible to POODLE.