2,510 reputation
11115
bio website stratigery.com
location Denver, CO
age 53
visits member for 3 years
seen Apr 3 at 23:27

Feb
25
comment How big is the threat of Desktop Linux malware?
@curiousguy - great. Write your own explanation of why Linux has so much more malware than Windows. Oh, wait...
Jun
22
comment Are Linux vendor-supplied security updates enough for PCI Compliance?
Don't confuse "PCI DSS compliance" with "security".
Jun
14
comment Why is blog spam always written so badly?
+1 for mentioning the Herley paper. All of the explanations above assume huge amounts about spammers that can't often all be true.
Mar
18
comment Concrete figures on password cracking in the wild
Why leak the password DB if you're not going to crack the passwords - I don't think you can safely try to guess motives on that sort of thing any more. We've seen enough Anonymous and just plain random things (like the leaked credit reports last week) for me to believe that imputing a motive makes sense.
Feb
17
comment Need advice on linux server being hacked
That crontab entry is bizarre and interesting. If you google for skdet, you find that it's a circa 2008 rootkit detector. skdet.tgz seems to constitute a rootkit, albeit one that has 2004 dates on all files. The readable parts look ancient, and like they don't work. I bet the crontab entry isn't the real rootkit, just some vestigial code left in the real rootkit.
Feb
6
comment How do antiviruses scan for thousands of malware signatures in a short time?
Are you sure about ignoring non-executable files? Given how often a Windows exploit pops up using a previously believed-to-be-un-executable file, and the lack of documentation about what extension goes to what executable, I'd think that every file would have to be scanned.
Jan
2
comment Are older viruses removed from virus definition files?
I suspect that the answer is "no, they're never removed", as there's no incentive for A-V companies to remove signatures of old viruses. The old viruses never change, so the signatures can just rest in peace. On the other hand, if you take out a signature too early, well, "Virus Bulletin" might ding you when you can't detect EICAR.COM or something really ancient, Lehigh, maybe.
Dec
20
comment How can I explain SQL injection without technical jargon?
@Kevin - well, I believe this site has a pretty international audience. I've only written checks in the USA, I would guess that UK or European checks would work similarly, but I don't know personally. I haven't written many for some years. I mostly do payments on-line. So "back in the day" seems correct to me, as does "In the USA". Please accept my most humble apologies for any misapprehensions I might have promulgated. I only meant to give an analogy that might not apply anywhere outside the USA.
Dec
20
comment How can I explain SQL injection without technical jargon?
@Kevin - I'm told that checks/cheques are pretty rarely used in the UK and maybe elsewhere in Europe. I very rarely write out a check these days, although I often do ACH, which doesn't require me to write much, if anything.
Dec
15
comment Lamp server sandbox for testing malicious php script
The difficulty with that is that calls to eval() can be arbitrarily obfuscated. If you don't discover and replace all calls to eval(), you can end up running the malicious code, instead of writing it to a file.
Nov
19
comment How do you explain the necessity of “nuke it from orbit” to management and users?
Good answer, KDEx: security is an economic good, with a cost and a value. My own thought is that the X% of malware is probably wildly overestimated, leading the the "nuke it from orbit" habit, but I've only really dealt with Solaris and Linux malware. Windows malware certainly sounds weirder and more persistent.
Nov
15
comment Determining how my Wordpress website was compromised
Why so skittish about details? Clearly, someone has figured these things out, and clearly they get used in the wild. Why bother concealing the details, if they make your explanation less clear, and more confusing?
Nov
15
comment Determining how my Wordpress website was compromised
Dear Mr Dali: I love your painting "Geopoliticus Child Watches the Birth of the New Man".
Nov
15
comment Determining how my Wordpress website was compromised
I'd be interested in how it got hacked. I see a lot of (apparently) WordPress vulnerability scanning in my access_log file, but I can't lure anyone into sending me their payloads, no matter what weak plugin I try to emulate. Actually, I think that a good proportion of the scanning for WordPress vulnerabilities just won't work - the skiddies involved got duped into running bad code.
Nov
9
comment Is there a website or free downloadable program to identify and remove malware from an ISO file?
Can malware infest an image file? I mean, beside naming an executable on Windows NudeJenniferLopez.jpg.exe and praying someoe is dumb enough to click it, does any image file format have enough executable or interperable parts to carry malware?
Oct
31
comment Example of a backdoor submitted to an open source project?
+1 for vaguely menacing vagueness! Thanx!
Oct
31
comment Example of a backdoor submitted to an open source project?
Thanks for the OpenBSD IPSEC stack link. I vaguely remember that. Did anything come out of that allegation? I Googled for a while, and found a bunch of denials, but nothing definitive.
Oct
30
comment Parabolic Denial Of Service — Would it work?
@November - the clearest explanation of multicast I found: www4.ncsu.edu/~rhee/clas/csc495j/ip-multicast-part1.pdf As Jeff Ferland notes, the routers have to be in on the multicast, so if you're not on the same subnet, you can't use multicast to amplify even further.
Oct
26
comment Repudiation in Copyright Infringement (BitTorrent)
"Laws do not persuade just because they threaten." The Roman orator Seneca said that sometime before 65 AD. I don't think the human situation has changed much.
Oct
26
comment Repudiation in Copyright Infringement (BitTorrent)
@Null: Open Wifi is not negligence in the USA right now: eff.org/deeplinks/2012/07/…