1,759 reputation
212
bio website
location Tulsa, OK
age
visits member for 2 years, 6 months
seen 5 hours ago

15 years enterprise IT / Infosec experience and counting...


Apr
30
comment Someone Copied Our Site Code (Including Analytics) and Put Adult Content on It
Will this filter prevent the OP from being alerted someone has copy/pasted his site?
Apr
23
comment Understanding Certificate Pinning
Kudos for the SSH comparison.
Apr
22
comment How to find out if somebody is spying on my private browsing data in the same WiFi network?
There is no way for you or anyone else to know for sure. We can only make assumptions.
Apr
21
comment How to keep logs safe from attackers?
Sounds like you need a SIEM.
Apr
17
comment Does http.sys vulnerability affect Windows not running any webservers?
Please review: news.ycombinator.com/item?id=9378449
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
One thing to note, if the users have a propensity to click past certificate warnings then the attacker doesn't have to take the DNS down, or force a connection by IP. The attacker can spoof any secured site with a MitM and the user would click passed the warning prompts.
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
In that very specific scenario, yes. But I would hope if the user is savvy enough to access the site by IP, I would hope they would be savvy enough to read the warning for the reason "why" the certificate was untrusted when accessing the site by IP. Was it because there was a name mismatch? Was it because the certificate chain was broken? Was it because the CA was untrusted? The latter two would indicate a possible MitM attempt.
Mar
30
comment Kerberos Authentication
I found RogueLynn's explanation to be very helpful. roguelynn.com/words/explain-like-im-5-kerberos
Mar
30
comment Suspicious GET request parameter list?
Any GET request that isn't part of your expected GET request in accordance with the web application design flow is suspicious. Like Question Overflow said, there are too many to list.
Mar
23
comment Is Clickjacking a real security vulnerability?
One can also log keystrokes via an iframe if framebusting techniques are used.
Mar
22
comment Which is first job or certificates
Just an FYI, you're not qualified to take the CISSP exam. You must have a minimum of five years of direct full-time security work experience in two or more of the 10 domains. For all requirements, please review: isc2.org/cissp-professional-experience.aspx
Mar
18
comment Does this image contain secret data?
File seems fishy to me. At best it's bad practice (SEO / Webmaster wise) to have a >3mb file size for a 16x16 icon.
Mar
12
comment In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?
It used to be quite common actually to utilize lower grade encryption in mobile or battery powered hardware to reduce CPU cycles and battery consumption. For example, the NintendoDS supported 64bit WEP only for those reasons.
Mar
11
comment proxy servers and restricted work computers
This may or may not work depending upon the OP's employer's VPN solution - at least I haven't had much luck establishing a network level VPN connection inside of a VPN connection.
Mar
5
comment Is plain text over https really a good idea?
POST payload is not logged in the Webserver logs.
Mar
3
comment List of cookie parameter names to identify load balancing mechanism
A10 loadbalancers use a "sto-id" cookie by default, though the administrator can technically name the cookie whatever they want.
Feb
4
comment Is there a “security fail forum / website” with lessons learned?
FailyMonster on Twitter reports on these type of incidents. twitter.com/failymonster
Jan
30
comment Check SSLv3 in Apache Tomcat locally as well as on server on windows/linux
Also keep in mind if your webserver is behind a load balancer that is offloading/inspecting/handling SSL traffic it may be vulnerable.
Jan
29
comment Could someone stop another from accessing their own online account?
I think you meant to say, how would Bob defend himself if Alice had a small team. ;) The best way to mitigate this attack if there is a small team willing to enter captchas would be to enable 2 factor authentication for the account. It's actually very easy to configure and use, and would prevent all the scenarios outlined above from being successful.
Jan
28
comment Someone or something tried to login to my Gmail using IP address of my shared hosting
You can also go to myaccount.google.com From there you can review "Devices" under "Recent Activity". Also, check under "Account Permissions" for "Connected apps and services".