1,891 reputation
1820
bio website
location United Kingdom
age
visits member for 1 year, 2 months
seen 2 days ago

Oct
24
comment Is this a phishing attempt? if yes where to report?
understandably I can see your point; however, to quote Einstein: "Only two things are infinite, the universe and human stupidity, and I'm not sure about the former."; plus if it is company's policy, just because we assume the person could not humanly be stupid enough to do that, does not mean we can go ahead and take matters onto our own hands. Also, assuming he did not this on purpose, after being told he might try and remove the exploit/virus/Trojan himself, hampering any potential forensic investigation.
Oct
24
comment Is this a phishing attempt? if yes where to report?
Reporting this to the coworker might not be a good approach: as yourself have pointed out, the coworker could be the responsible for this. According to many company's policies, this should be escalated to the Fraud/InfoSec departments if the company has these departments, or escalate it to a line manager.
Oct
24
comment What steps need to do to identify security hole
At the risk of being ultra-paranoid, creation/modification date/time are not enough, as they can also be manipulated.
Oct
24
comment How is time-based SQL injection different from other types of SQL injection?
@AviD♦ - really interesting answer; it made me realise two things: 1) that the concept is simple, but 2) that the real trick is in how we actually approach the problem. Very elegant answer; thank you: +1.
Oct
21
accepted Manual Checks for Signs of Infection on Windows 7
Oct
17
comment Manual Checks for Signs of Infection on Windows 7
+1; thank you. You were spot on the "pre-2008" part. I learned this "method" during the early years of XP. Still on this subject, you've mentioned that pre-2008, this method was "an acceptable forensic approach for a beginner to intermediate level". Still within the pre-2008 context, what were the advanced level's approach? Fancy EnCase forensics? Or was the advanced approach the basic wiping-and-rebuilding?
Oct
17
comment Manual Checks for Signs of Infection on Windows 7
Thanks for your answer: it seems to tie in with Adnan's too. +1 for the Safe Mode explanation. Could you please expand on this one? 'To be undetectable' while in Safe Mode?
Oct
16
comment How to secure my network, laptop, ipad and email accounts which are possibly hacked?
@Shams - What did you to ensure you were really talking to Yahoo! support? Where did you get their phone numbers from? At the risk of being ultra-paranoid, if you have searched for their phone numbers on the same potentially hacked computer, or even on a different computer but within the same network (e.g., your home network), you should not assume you are talking to the actual Yahoo! support team.
Oct
12
asked Manual Checks for Signs of Infection on Windows 7
Sep
26
awarded  Popular Question
Sep
11
comment Running arp command on public wifi network
@user30673 I feel you fear, and I believe you do well in asking. It is good to know that more people are becoming security-aware.
Sep
11
comment Running arp command on public wifi network
@user30673 My pleasure. That is interesting... I never experience such a delay. I guess depending on your machine's speed and the amount of entries on the cache this could create a slight delay, depending on how long it took you to kill the process. Nothing stops you from flushing the cache and have a new list being built from the scratch. The way to do this depends on your Operating System, though.
Sep
11
answered Running arp command on public wifi network
Sep
6
answered How to find vulnerable sites on a web server
Sep
4
revised Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field
deleted 1 characters in body
Aug
7
comment Does adding a non-entropic part to a password makes it less secure?
So is there anything that can calculate the entropy? For example, how can I know if a password like '=+*/-$' is stronger/weaker than 'thisismypassowrdIbetyoucantcrackit'?
Aug
7
comment Implementing 'Remember Me' for a mobile application
That was excellent (+1). Out of sheer curiosity, may I just ask: "Javascript is not at all the right language for that". Which language is it then, if any at all?
Aug
6
awarded  Informed
Aug
5
comment Custom web authentication scheme
"[...] if you have SSL, then Basic authentication (aka "show the password") is fine.": on a SSL MITM, would the credentials of a genuine user not run the risk of being intercepted and replayed (having in mind that apparently the majority of users ignore the certificate error and click on anyway)?
Jul
22
comment WAF Process Creation for Integration of IT and Business
thank you so much for sharing your view. You have given me a lot of information. What you said that the "first breakout should be organization or discipline related" makes a lot of sense and I am definitely taking this one with me. Also the "unknown process" is gold - thanks for that. Keeping the document as dynamic as possible ("living document") was something I had not considered either: very interesting. Above all, I am very grateful for what you said about known attackers and vulnerabilities: much broader view that the one I had. Definitely a +1. Thanks again.