2,540 reputation
11115
bio website stratigery.com
location Denver, CO
age 53
visits member for 3 years, 4 months
seen Jul 17 at 13:16

Sep
27
comment Ways to monitor someone's internet traffic
Ultimately, I don't know, but unless the VPN makes some effort to confuse traffic analysis, stuff can leak. See: crypto.com/papers/jbug-Usenix06-final.pdf The "jitterbug" outlined in that paper could be used by the backdoor to sneak info out.
Sep
27
answered Ways to monitor someone's internet traffic
Sep
12
comment How helpful is rkhunter?
Not debating the need for a risk calculation. But I don't believe that rkhunter does all that much: the only realy root kit I ever got hit with still wouldn't be detected. I am arguing against making an absolute requirement for linux out of a "best practice" for windows installations.
Sep
12
comment How helpful is rkhunter?
Is that a real suggestion, or a "motherhood and apple pie" suggestion, like early PCI DSS insistence on a "malware checker" on every computer, which was slightly ridiculous for say, Paymentech's Stratus front ends.
Sep
12
comment How helpful is rkhunter?
Suppose the distro is Arch, with a rolllig release and a preference for "cutting edge". It will be harder for someone to write a root kit, as Arch installation continually roll kernel versions and directory structures.
Sep
11
comment How helpful is rkhunter?
I commend you for recognizing that security is an economic good, with a value, and a price, and an opportunity cost. rkhunter appears to be linux (or maybe linux & BSD & unix) specific. Without knowing what distro the asker uses, the price and opportunity cost are impossible to calculate.
Aug
29
comment What does WEP access point show during aircrack-ng attack?
I'm just doing this to see how things work, not to run an Access Point. To crack WEP, the attacker runs "aireplay-ng" in the ARP Replay mode. So the attacker is not entirely passive, is he/she? Can I see the results of the ARP replays?
Aug
27
awarded  Student
Aug
27
asked What does WEP access point show during aircrack-ng attack?
Aug
22
awarded  Commentator
Aug
22
comment Is it safer to use less heard of software than popular software?
Can you cite some CVE's for wget getting exploited?
Aug
15
comment Who are these crazy referrers?
Do enough people look at "referer", and then double-check the weird ones, to make this technique work? I look at my apache logs and I have noticed the weird referer values lately, but I haven't clicked them, as they look too stupid.
Aug
14
comment How do polymorphic/metamorphic/self-encrypting/self-changing file infectors know if they have infected a file or not?
Changed the link, thanks for letting me know. Yes, maybe less-than-perfect detection works in practice. But the theoretical result shows that sort of thing turns into an "arms race".
Aug
14
revised How do polymorphic/metamorphic/self-encrypting/self-changing file infectors know if they have infected a file or not?
added 34 characters in body
Aug
13
awarded  Caucus
Jul
23
awarded  Enthusiast
Jul
16
answered SUN Remote Procedure Call Port 111
Jul
10
answered Why does the government/military not use special operating systems?
Jul
8
revised Identify an HTTP scanner from some HTTP headers
added 323 characters in body
Jul
6
comment Identify an HTTP scanner from some HTTP headers
Right, and I noted that above: User-Agent changes, but the Accept, Accept-Language and Accept-Encoding do not change. Besides, it's pretty clearly not a "decent vulnerability scanner" - it's some kind of half-baked script-kiddie cr@pcode.