386 reputation
111
bio website
location Norway
age
visits member for 4 years, 3 months
seen 7 hours ago

whitehat


Mar
7
comment How to perform security exploits/penetration on devices like iPhone's, PSP's, and Android to run your owncode?
I think you should be more specific - as each device is different, how you exploit or pentest each device is inherently different. At least technically. Many of the principles are of course the same as with all clients, be it a Windows computer or an Android device.
Feb
22
comment Is accessing bank account on the internet really secure?
@AviD just a typo, I meant authentication of course. But in Norway where I'm from I have not heard of any bank that don't use two-factor authentication. I actually thought that was a requirement for PCI compliance, but of course it might just be an "extra service" our banks provide.
Feb
19
comment Does strong naming remove the need for packing/obfuscation?
I agree you are right. However everywhere I read about them they're presented as a security feature.
Feb
19
revised Does strong naming remove the need for packing/obfuscation?
added 7 characters in body
Feb
19
revised Does strong naming remove the need for packing/obfuscation?
Edited to add answer
Feb
16
accepted Does strong naming remove the need for packing/obfuscation?
Feb
16
comment Does strong naming remove the need for packing/obfuscation?
Okay, so long as the attacker has control over its GAC they will be able to do this. I'm accepting this answer.
Feb
16
comment Does strong naming remove the need for packing/obfuscation?
How would you hack the verification code? It's signed using a 1024 bit RSA key. As to updating the references I see this is a possible way, however with a large application this becomes a very daunting task. Say if you have an application with at least a 100 assemblies and a 100k lines of code, would it even be plausible?
Feb
16
comment Does strong naming remove the need for packing/obfuscation?
I've tried changing the assemblies of an application using Graywolf (digitalbodyguard.com/GrayWolf.html). However, when I try to run the application afterwards it fails because the classes are looking for assemblies signed by the original author. My modified assemblies have strong name with PublicKeyToken=null. How would an attacker overcome this?
Feb
16
revised Does strong naming remove the need for packing/obfuscation?
added 161 characters in body
Feb
16
asked Does strong naming remove the need for packing/obfuscation?
Dec
23
comment iOS/Android Pen-Test
Maybe this question should be broken into multiple questions? There is too much to answer - general methodology, android app testing, ios app testing, man-in-the-middle testing using SSL with or without client certificates... Then there's the whole OS/system itself which are probably full of vulns
Dec
20
comment Is accessing bank account on the internet really secure?
Question, are there actually any online banking out there that haven't started using two-factor authorization with one-time-passwords yet? I imagined that would be one of the assumptions here.
Dec
7
awarded  Commentator
Dec
7
comment Where can I find exploit code?
I don't argue that you are wrong. What I'm saying is that it is irrelevant to the question which is where do you find exploit code.
Dec
6
comment Where can I find exploit code?
Although true, this answer has nothing to do with the question asked.
Dec
5
comment How to force ALL programs to use my Proxy?
@pootzko default port for Fiddler so that would be my guess
Oct
28
answered How should a web page respond to a CSRF attack?
Oct
27
awarded  Critic
Oct
27
comment Is there a reason to disable root login, if SSH connections are restricted to a single IPv4 address?
-1 IP Spoofing over an SSL channel would be extremely difficult to acheive and does not strike me as feasible.