37,183 reputation
1488159
bio website linkedin.com/in/avidouglen
location Israel
age 40
visits member for 4 years, 8 months
seen 3 hours ago

Security expert and experienced Windows programmer


May
6
revised Has SHA-3 Arrived?
edited tags
May
6
revised Escaping JavaScript constants
edited tags
May
5
answered How do you compare risks from your websites, physical perimeter, staff etc
May
5
comment Effect of Source Code Leakage of a security suite on security
+1, also, in many cases the actual source code is what damages the reputation - when you see how badly this company writes code, would you still want to buy their product? Also, a security company should have been following a complete SDLC, in which case the source code should have minimal defects - if that's not the case, the fact that you can determine that they did not have SDLC in place, is damaging enough, even besides the actual flaws.
May
5
comment Does PCI compliance really reduce risk and improve security?
@caelyx, you're correct - this was my first iteration of that "law", on later questions here it was already generalized. :)
May
5
awarded  Nice Answer
May
4
revised Books on Cryptography, with a focus on application to Network Security?
edited tags
May
4
comment ip-fragmentation and mod_security?
(To be clear, I'm not claiming there is such a flaw, I havent tested this at all. I'm only raising this as a possible issue, and curious if there is special handling for these.)
May
4
revised How does the padding scheme impact the security of encryption
edited tags
May
4
revised What is War Dialing?
edited tags
May
4
comment How to step through malicious JavaScript?
+1 for actually doing this, in addition to general answer!
May
4
comment How to step through malicious JavaScript?
Heh, if you think real obfuscation can be solved by simple toStringing, you havent seen much code... even non-malicious javascript ;). But +1 on Firebug.
May
4
comment How to step through malicious JavaScript?
@Rakkhi, thats what I said, "create a new account and login with that".
May
4
answered How to step through malicious JavaScript?
May
4
comment ip-fragmentation and mod_security?
@Ryan, and as long as we're on this, a similar issue might present itself in edge cases, wrt Expect: 100 continue in a request header. (If a rule has some correlation between the first part of the request and the body...).
May
4
comment ip-fragmentation and mod_security?
Right, and modsecurity treats each response as standalone too. I guess this problem would only be relevant if you have rules that apply to your response - but if so, it would be possible to evade any of those rules, unless range headers are accounted for.
May
4
comment ip-fragmentation and mod_security?
@Ryan yes, I mean a request that includes Range headers. As you know, this can cause "special" behavior, where the exploit would not appear all at once, but split in two. This could allow an attacker to evade some types of WAF rules, unless explicitly handled for by the WAF. An issue that has buggered some of the other WAF products in the past...
May
4
comment ip-fragmentation and mod_security?
Thanks, @Ryan! And as long as you're on the line here :), what about range requests? Does modsecurity properly handle these, and apply rules correctly? How - aggregating, dropping, other?
May
4
revised What is the value of encrypting a payload when it will be transferred over sftp anyway?
edited tags
May
4
revised Effect of Source Code Leakage of a security suite on security
edited tags