1,424 reputation
410
bio website ewanm89.co.uk
location United Kingdom
age 25
visits member for 3 years, 3 months
seen 4 hours ago

I code for fun, mostly self taught, both high and low level. Also self taught in various aspects of information security. Love the puzzles.


Jan
12
comment How disable Java in Chrome 23?
Incidentally it's not a new 0-day, technically it's not even a 0-day as Oracle knew about it in August.... So lets be correct, it's a regularly exploited unpatched vulnerability.
Jan
12
comment In SSL/TLS, how is the authenticity of a server's certificate verified?
No tack signs the servers public key with its own keypair. We have the server sign it's public key with another keypair and after first connect we remember this second keypair and check that signature. Now the certificate is due for renewal and the server admin legitimately goes to another call, now just stop signing the old public key and start signing the new one with TACK, signature is valid so all is well. However for other changes the TACK signature will be invalid or missing and there is an error.
Jan
9
comment Does PayPal support a backup code for two-factor auth?
Yeah, I had to use it once when paypal started sending corrupted SMSes to everyone for several days... While I like 2-factor and use it on many systems, thanks to paypal 1) not being able to secure it properly (we all know security questions are bad, bad, bad and 2) messing up what they have managed, I nolonger feel it is worth it on paypal.
Jan
8
comment In SSL/TLS, how is the authenticity of a server's certificate verified?
'A "tack" contains a "TACK key" which is used to sign the public key from the TLS server's certificate. Hostnames can be "pinned" to a TACK key.' from ietf draft: tools.ietf.org/html/draft-perrin-tls-tack-01
Jan
5
comment How to solve race condition in 2-factor authentication solutions like RSA Security tokens or Google Authenticator?
Or just steal the cookies, if you have enough access to the client, secure flag or the fact it was sent over SSL isn't going to help.
Jan
5
comment What tools can be use for Security Auditing for Redhat
No automatic tool or group of tools is 100% inclusive, computers are designed as generic computing machines, this allows one to run ones own programs and services, run custom servers listening on various ports. Meanwhile, new attacks and methods are constantly being invented.
Jan
5
answered In SSL/TLS, how is the authenticity of a server's certificate verified?
Dec
30
comment Would it be possible to extract user agent strings from 3G/4G Data
Yeah, but there is no technical reason why it's not possible, in fact we can manage to do it illegally just fine. It's just the yahoos running the mobile carriers don't have any real expertise in proper networking.
Dec
29
comment What are RealVNC 5.0 Authentication Protocol Security Limitations?
I'm wondering how RealVNC are solving the MITM problem. I think I'll stick to transport across openssh tunnel.
Dec
29
comment Is it secure to install RSA SecurID Software Tokens on the same computer that will be used to access the VPN?
Technically yes it satisfies 2-factor authentication. However it is the same as say an SSL client certificate doing mutual SSL authentication to a web login page. Which can be done transparently without the user even knowing.
Dec
28
comment Is Data Remanence a Myth?
Personally, I'll go with thermite.
Dec
21
comment X.509 certificate attack (small sha1 private key)
Actually, if the quantum leap is quantum computers able to factorise numbers more than a few bits in length, then we have a problem. Currently quantum computers can factorise numbers about 4 bits long.
Dec
19
comment Changing user account passwords from PHP script - vulnerabilities?
If piping to another utility, why not pipe not passwd that is already installed? Not that it is a sensible idea in the first place, why not use a proper separate email database? You don't think google create system accounts for every gmail account do you?
Dec
18
comment Does a renewed certificate open old messages?
I assume we are talking S/MIME email here?
Dec
18
comment Is there any way to differentiate between a normal web request and a web service request?
What kind of security layer is it? Application level proxy/firewall or firewall with deep packet inspection properties or just a standard state-full firewall?
Dec
18
comment Is there any way to differentiate between a normal web request and a web service request?
A web service is just that a service that is accessed via HTTP... Technically the login form is a web service, I assume you mean that you have something replying JSON or XML to JSON or XML POST data, in which case you have to identify it the same way the web application does. Does it use a different ip address, domain name, specific page urlm always a different user agent (only works if there are dedicated clients, wouldn't rely on it at all and a javascript client will show as a standard web browser)...
Dec
16
comment Password Manager - id_rsa as key file
it's not 2048-bits of entropy though. That is why asymmetric keys are 1024-4096 bits long not 128bit - 512bit long keys. A 2048 bit RSA key pair is roughly equivalent to 112 bits of entropy, you might as well generate 128 bits of random data to use.
Dec
15
comment Password Manager - id_rsa as key file
As for centralising it, I just stick the encrypted keepass2 database in dropbox, should be no issues with keepass v.1 format files this way either. The only thing is one needs to make sure they reload the database (lock and unlock workspace in keepass2) if it has been changed on another machine.
Dec
15
comment Password Manager - id_rsa as key file
Yes, your keyfile should be random data, id_rsa is not random data, it is mathematically specific data.
Dec
12
comment Can I safely trust my Anti-virus protection?
@Mok-KongShen no, certainly not, infact when playing in CTF and red team/blue team wargames the security system is often a fun and common attack vector. Also Peiter C. Zatko (Mudge) in the keynotes for Shmoocon, Blackhat USA and Defcon conferences in 2011 went into his work at DARPA into how the biggest attack area is the thousands of lines of code in the massive IDS and firewall systems used in military information networks.