2,935 reputation
11216
bio website stratigery.com
location Denver, CO
age 53
visits member for 3 years, 9 months
seen Dec 11 at 22:10

Oct
2
answered How a malware executes remote payload
Sep
28
comment Are anti-virus companies companies regularly committing software piracy?
Good. I upvoted.
Sep
28
comment Are anti-virus companies companies regularly committing software piracy?
We're not discussing detecting malware, we're discussing possession of a huge amount of copies of software, possibly in contravention of international treaties, like ACTA. In the USA since 1976, and elsewhere since the Berne Convention was ratified, any intellectual property is automatically copyrighted by the creator. It strikes me that most of the posters here are arguing good intent, but most copyright law does not allow the consideration of intent or state of mind. Mere possession is illegal.
Sep
28
comment Are anti-virus companies companies regularly committing software piracy?
I personally can go with this, but in the USA fair use is only something that can be discovered through lititgation. You have to go to trial to find out. Without a trial, you're skirting legality at best. Further, fair use is something you plead AFTER YOU ADMIT TO COPYRIGHT VIOLATION. It's not usable up front.
Sep
28
comment Are anti-virus companies companies regularly committing software piracy?
You guys need to look into the "intent" issue. In newer laws in the USA, "intent" (or "mens rea") is often very explicitly LEFT OUT of consideration. Just doing something, copying a file or even possession, is enough to make you guilty. The DMCA does this sort of thing, as do a lot of the more recent copyright laws.
Sep
27
revised Ways to monitor someone's internet traffic
Add note about traffic analysis.
Sep
27
comment Ways to monitor someone's internet traffic
Ultimately, I don't know, but unless the VPN makes some effort to confuse traffic analysis, stuff can leak. See: crypto.com/papers/jbug-Usenix06-final.pdf The "jitterbug" outlined in that paper could be used by the backdoor to sneak info out.
Sep
27
answered Ways to monitor someone's internet traffic
Sep
12
comment How helpful is rkhunter?
Not debating the need for a risk calculation. But I don't believe that rkhunter does all that much: the only realy root kit I ever got hit with still wouldn't be detected. I am arguing against making an absolute requirement for linux out of a "best practice" for windows installations.
Sep
12
comment How helpful is rkhunter?
Is that a real suggestion, or a "motherhood and apple pie" suggestion, like early PCI DSS insistence on a "malware checker" on every computer, which was slightly ridiculous for say, Paymentech's Stratus front ends.
Sep
12
comment How helpful is rkhunter?
Suppose the distro is Arch, with a rolllig release and a preference for "cutting edge". It will be harder for someone to write a root kit, as Arch installation continually roll kernel versions and directory structures.
Sep
11
comment How helpful is rkhunter?
I commend you for recognizing that security is an economic good, with a value, and a price, and an opportunity cost. rkhunter appears to be linux (or maybe linux & BSD & unix) specific. Without knowing what distro the asker uses, the price and opportunity cost are impossible to calculate.
Aug
29
comment What does WEP access point show during aircrack-ng attack?
I'm just doing this to see how things work, not to run an Access Point. To crack WEP, the attacker runs "aireplay-ng" in the ARP Replay mode. So the attacker is not entirely passive, is he/she? Can I see the results of the ARP replays?
Aug
27
awarded  Student
Aug
27
asked What does WEP access point show during aircrack-ng attack?
Aug
22
awarded  Commentator
Aug
22
comment Is it safer to use less heard of software than popular software?
Can you cite some CVE's for wget getting exploited?
Aug
15
comment Who are these crazy referrers?
Do enough people look at "referer", and then double-check the weird ones, to make this technique work? I look at my apache logs and I have noticed the weird referer values lately, but I haven't clicked them, as they look too stupid.
Aug
14
comment How do polymorphic/metamorphic/self-encrypting/self-changing file infectors know if they have infected a file or not?
Changed the link, thanks for letting me know. Yes, maybe less-than-perfect detection works in practice. But the theoretical result shows that sort of thing turns into an "arms race".
Aug
14
revised How do polymorphic/metamorphic/self-encrypting/self-changing file infectors know if they have infected a file or not?
added 34 characters in body