26,834 reputation
1061140
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 3 years, 5 months
seen yesterday

Security expert and experienced Windows programmer


2d
comment How to make a captcha maker
Why would you want to? Research the topic, beginning with some of the posts here, and you'll see that CAPTCHA has been proven, for most scenarios, to be of little value. Also, there are plenty of existing libraries and services - so, considering that you're asking how to do it, I would assume that you don't necessarily have a better idea than they do. On the other hand, if you're doing it solely for education, then still - there are better ways to do so.
Apr
16
comment How can I setup my local server and do a heartbleed attack on it?
Not on topic here, but just use a vulnerable version of OpenSSL....
Apr
16
comment Is it possible to slow down the Blue Midnight Wish cryptographic hash function?
When it comes to cryptography, "obscure" != "better". In fact, for most values, they are opposites.
Apr
11
comment Should I cancel my current credit card because of heartbleed vulnerability?
If none of the answers there mention this, then apparently you don't. There is no list of "what should end-users not bother doing".
Apr
11
comment Does Heartbleed vulnerability affect other libraries (like BouncyCastle, .NET's SslStream, etc.)?
of course. But why stop at the TLS implementation? This bug had nothing specifically to do with that, it just happened to be in TLS code. So check any other software package (actually yeah, this is a good idea). But where to stop? That would make this way too broad a question, if that is indeed what you are asking.
Apr
10
comment Does this reflected XSS vulnerability pose any real threat?
Take a look at DOM based XSS. It might be relevant to you, but it's hard to tell without seeing the full context of how the field, div, scripts, etc are used. Also, is this pure javascript, or some kind of js-framework (e.g. Angular)?
Apr
10
comment Do I need to worry about my SSH keys if my system was vulnerable to Heartbleed?
See also security.stackexchange.com/q/55217/33
Apr
10
comment Does Heartbleed vulnerability affect other libraries (like BouncyCastle, .NET's SslStream, etc.)?
The problem is not about SSL, it's about OpenSSL. A very specific package, that provides an implementation of SSL (among other things)... Nothing to do with any other SSL implementation.
Apr
10
comment Does xkcd.com/1353 overstate heartbleed's capability?
Is it just me, or is that xkcd just dripping with sarcasm? It seems to be mocking all the mass hysteria which is doing the overstating....
Apr
10
comment Does Heartbleed vulnerability affect other libraries (like BouncyCastle, .NET's SslStream, etc.)?
I don't understand why you're asking about how a bug in specific library affect other libraries....
Apr
10
comment Can Heartbleed be used to obtain memory from other processes?
@Lekensteyn and btw ftr neither does IE...
Apr
10
comment Should I change all my passwords due to heartbleed
I think you missed the point of that xkcd... namely the dripping sarcasm. Your answer is also a bit blown out of proportion, but that at least is in tune with most of the mass media's treatment of this.
Apr
8
comment Why did Java (JRE) vulnerabilities peak in 2012-2013?
@ntoskrnl and goldilocks - why are you so hung up on applets? Can there not be security flaws without applets?
Apr
4
comment No single quotes is allowed, Is this SQL Injection point still exploitable?
Wow, that paper is brilliant! ;-)
Mar
18
comment Is a console application with NT Authority/System rights dangerous?
Excellent point. And as long as you're on that, he can then easily install a rootkit in the GINA / CredProv, so any domain admin that logs in in the future will also have his password stolen....
Mar
18
comment Is a console application with NT Authority/System rights dangerous?
It's a backdoor, is what it is. You fix it by formatting and reinstalling the OS (since you have no real way of knowing what was done by whom), then NOT giving admin rights to this negligent developer... (or at least give him some training on some basic security awareness....)
Mar
17
comment Is a console application with NT Authority/System rights dangerous?
Of course, I assumed you would be - didn't mean to imply otherwise :-) Like I said, the domain admin accounts are not going to be compromised (assuming this is not on the DC), however the domain computer account for this machine is. So, it's a question what "privileges" this computer account has across the domain. Assuming "more than nothing", if you believe that arbitrary anybodys had complete access to it, I think you should disconnect it. Though if you have reason to believe that only e.g. trusted sysadmins had access, then it's a risk management decision...
Mar
17
comment Which OpenSource Proxy is Better and easier to use?
Besides that the question is closed since we don't accept product recommendation requests here, there have been many questions in the past that have mentioned many of these products. On a personal note, I much prefer Fiddler most of the time.
Mar
3
comment Possible attack on website
Fair enough, so you really meant "... very little knowledge about web attacks". Though even then, that is far from optimal... Better, but not great. :-)
Mar
3
comment Possible attack on website
Hi Pramodtech, welcome to Information Security. I apologize if this will sound gruff, but I take personal offence at your statement "a developer and I therefor I have very little knowledge on security". I am a developer, and though my personal focus is on security, every programmer must be well-versed in at least the basics of security. Saying "I just write code, so I dont know much about security" is akin to saying "I just drive my car, so I dont know much about road safety". Seriously, if you feel you dont know much about road safety, step away from the vehicle until you learn the basics.