2,023 reputation
514
bio website saconsumer.com
location San Antonio, TX USA
age
visits member for 3 years, 4 months
seen 1 hour ago

Aug
21
comment What sensitive information can be leaked in a Vim's swap file?
+1 good question but you already know the answer. Good advice out there as to how to move the swap to /tmp on StackExchange etc.
Aug
20
comment Are digital signature algorithms subject to the same types of attack as public-key encryption algorithms?
You are under the impression that PKI is vulnerable at this time?
Aug
15
comment Is this behavior the result of malware?
If you have to expose your EC2 instance to the entire Internet you should consider making a snapshot of it prior to publishing it. Reboot the snapshot instead of the instance and any headway by attackers will be eliminated. Of course a weak system will probably get re-exploited but your baseline will always be available to reuse/harden.
Aug
14
answered Is it possible for a phone to be transmitting even while turned off and the battery removed?
Aug
11
comment What are the biggest security concerns on PXE?
Sorry to not be clearer my point was the attacker does not need to hijack your TFTP session he can just initiate one himself at will.
Aug
8
comment Public/Private key validation
Per the documentation you passed "SoftActivate Licensing Server is a web service which processes product activation requests sent by the products at activation time". So you have to have a license server to challenge the public key with private key information (not available locally to the client) as part of the 'phone home' initialization process. Consider giving them a working executable without this feature.
Aug
8
comment Public/Private key validation
So a trivial interaction that does not protect the intellectual property from theft? Why are you challenging the user for a license?
Aug
8
comment Public/Private key validation
Is the user always online or is the event expected in a mode that is sometimes offline? How important is counterfeiting via key reuse through software copies distributed to others? Need more details about the client, the user, and the use case.
Aug
8
comment What are the biggest security concerns on PXE?
+1 for physical security focus.
Aug
8
comment What are the biggest security concerns on PXE?
TFTP does not need a man in the middle it is trivial as in no authentication thus the first T in TFTP.
Aug
8
revised Appropriate response to 2014 Russian Security Breach (CyberVor)
added 1 character in body
Aug
6
answered Appropriate response to 2014 Russian Security Breach (CyberVor)
Aug
5
answered Does the EICAR test work on Linux based antivirus scanners?
Jul
31
awarded  Nice Question
Jul
9
comment Making it harder to scan on-screen QR-code from a distance
If there were a market a software solution could completely cover the code with an obscuring window and convert the value to text for you. Assuming the code relates to value like Bitcoin consider not using the QR but the value instead. QR by design is meant to be read by all who can see it thus a better method of access to the value it contains might be your fix.
Jul
8
comment Issues with format of Logs generated by Auditd
your post was updated and I see the name arugment commented out and name_format listed- answer below should still work fine
Jul
8
answered Issues with format of Logs generated by Auditd
Jul
2
awarded  Curious
Jun
2
comment How do you stop a hacker when their IP address is 0.0.0.0?
Seems you are not alone - ditted24.rssing.com/browser.php?indx=12949233&item=666
May
21
comment Do software systems become more secure every year?
It might be helpful to go beyond the human users are getting dumber and the human attackers are getting better. Systems of systems growing in both complexity and ubiquity may suggest the OP's proposition that the systems are more secure may be fundamentally flawed and incorrect. Seems we in the InfoSec business should look hard at this aspect as it may suggest our train user and patch, rinse, patch methodology might not keep up with the leaks in the boat. EBay today, Target five months ago, yada yada. InfoSec as a business seems to need some fundamental systems level changes to status quo.