Reputation
416
Top tag
Next privilege 500 Rep.
Access review queues
Badges
2 12
Newest
 Nice Answer
Impact
~7k people reached

  • 0 posts edited
  • 0 helpful flags
  • 23 votes cast
Aug
24
comment What is this URL Injection piece of code mean?
For this to work they would have to have uploaded this file (somehow) into your application, so that when accessing this shell from your application, they can utilize this to run arbitrary code on your server. However, I have no idea if they have succeeded including this shell on your server so this might be scary, or more likely not. Attempts to upload shells like these are common by robots attempting every IPv4 address looking for a vulnerable host.
Aug
6
comment Is it dangerous to have the built-in Administrator account enabled?
While I do agree with that statement, I would also like to see an argument stating what risks one might get by not disabling the user if it's never used.
Jul
30
comment Persistent XSS in Blogger domain
How so? I totally agree with Google that this is not different from you setting up your own website where you have full control over your malicious js. If he was able to inject persistent xss on some other blog without editing access that would be a different story.
Jul
30
comment Would the Stagefright vulnerability existing in Android be able to run on other phones?
@MikeOunsworth Actually, BlueBox states this: "Typically, Nexus devices will have to wait until the next major Android release for fixes to be received." I do not know if this is true though.
Jul
29
comment Would the Stagefright vulnerability existing in Android be able to run on other phones?
@MikeOunsworth That's true.
Jul
29
comment Would the Stagefright vulnerability existing in Android be able to run on other phones?
@MikeOunsworth Because fragmentation. If you're on a nightly channel for CM you get updates and fixes all of the time. With stock you have to wait until your phone manufacturer and in some cases your network provider to push an OTA update. And that is IF they'll even push an update...
Jul
29
comment Centralized local hosted web based password manager
Check out keepass.info. It is not web-based, but you can have a db-file per employee stored centrally on your LAN. I think its better than web-based because no XSS will be able to steal from a separate application.
Jul
29
comment Would the Stagefright vulnerability existing in Android be able to run on other phones?
If it only were a bug in Hangouts this wouldn't be such a problem because it would be easy to push an update through Play Store. This bug really shows the security value of using CM compared to stock Android.
Jan
12
comment How to protect the company VIPs
I just cant wrap my mind around letting management people have local admin rights... Good luck, you're gonna need it.
Dec
18
comment Is SSL more secure than encoding?
I was referring to the expression "security by obscurity", which I don't find to have anything to do with real security. I think we agree, but maybe not on the meaning of the expression :P
Dec
18
comment Is SSL more secure than encoding?
What you're describing is "security by obscurity". While it might fool the "internet cafe owner", it most certainly won't withstand the scrutiny of any security research.
Jan
22
comment Swap file may contain sensitive data
Lets say I set up Debian with encrypted LVMs (standard setup) would that mean this is set up?
Jan
19
comment Swap file may contain sensitive data
Nice one. Is there a similar easy fix for Linux without using protected memory?
Jan
13
comment UNION SQL Injection
you need to close the query before the comment
Nov
24
comment What are the main weaknesses of mobile software based OTP generators?
Agreed. It would be easy to reverse engineer the OTP-generation algorithm and learn future passwords.
Aug
14
comment Is this a ViewState attack?
Is this the only occurrence from this IP? For me the suspicious part is the " ' " character, which is often used for probing SQL injection vulnerabilities.
Mar
8
comment How to perform security exploits/penetration on devices like iPhone's, PSP's, and Android to run your owncode?
No need to apologize :) I like the question, but maybe it should be broken into multiple more specific ones. And I too am very interested in this topic. For reference I've been testing Android apps and this might point you in the right direction for that: intrepidusgroup.com/insight/2011/05/androidaudittools and wsec.be/blog/2011/10/05/adventures-in-pentesting-android-apps
Mar
7
comment How to perform security exploits/penetration on devices like iPhone's, PSP's, and Android to run your owncode?
I think you should be more specific - as each device is different, how you exploit or pentest each device is inherently different. At least technically. Many of the principles are of course the same as with all clients, be it a Windows computer or an Android device.
Feb
22
comment Is accessing bank account on the internet really secure?
@AviD just a typo, I meant authentication of course. But in Norway where I'm from I have not heard of any bank that don't use two-factor authentication. I actually thought that was a requirement for PCI compliance, but of course it might just be an "extra service" our banks provide.
Feb
19
comment Does strong naming remove the need for packing/obfuscation?
I agree you are right. However everywhere I read about them they're presented as a security feature.