14,347 reputation
23250
bio website
location
age
visits member for 3 years, 4 months
seen 2 hours ago

Security, Unix, and Networking jack-of-all-trades, master-of-some.


Nov
2
comment What is this strange GET request (GET /A0A32579-2767) DoSed my apache?
I suggest you capture the full content of the request - specifically, the HTTP headers. It's unlikely that the URI itself was what was impacting Apache. But if you're vulnerable to Shellshock, for example, those requests could've had a whole lotta shaking going on your server.
Nov
2
awarded  Good Answer
Nov
2
comment Is it fundamentally possible to validate that an unmodified version of your client connects to your server?
@Mehrdad, nothing says the hacked client is the same code base as the valid client - it just has to present correct enough inputs to convince you it's the valid client. And timing can be closely analyzed and, if necessary, mimicked.
Nov
2
reviewed Leave Open Are there any good tools to test the encryption quality of data?
Nov
2
reviewed Leave Open How can I get other person's packets over Wireshark?
Nov
2
reviewed Leave Open Is it fundamentally possible to validate that an unmodified version of your client connects to your server?
Nov
2
reviewed Close Bridge wifi connection?
Nov
2
reviewed Close Email obfuscation/munging recent research
Nov
2
reviewed No Action Needed Microsoft OneNote being detected as Malware
Nov
1
awarded  Good Answer
Nov
1
awarded  Enlightened
Nov
1
awarded  Nice Answer
Nov
1
revised Is it fundamentally possible to validate that an unmodified version of your client connects to your server?
The 'Yes' had the opposite effect intended when compared to question.
Oct
31
answered Is it fundamentally possible to validate that an unmodified version of your client connects to your server?
Oct
31
comment What stops a developer from accessing credit card details and other secret data from a company
@PeriataBreatta, no, but for a business that develops their own software for card processing purposes, it might be. That's a very small minority of DSS businesses! Bear in mind that the PCI DSS scales from the most minor merchant to the largest payment processor - you may want to see how the various SAQs fine-tune it's impact on differently organized businesses.
Oct
30
awarded  Nice Answer
Oct
30
comment What stops a developer from accessing credit card details and other secret data from a company
It's very difficult to do on a shoestring operation, because the key ingredient is separation - separation of duties, separation of access, separation of oversight. And a startup doesn't have the bodies to spare for separation. If your concern is other people impersonating you, consider enhanced authentication - 2-factor with time-based tokens, for example, they're unlikely to steal your laptop and your fob/phone and your PIN.
Oct
30
revised What stops a developer from accessing credit card details and other secret data from a company
Expanded in response to comment feedback
Oct
30
answered What stops a developer from accessing credit card details and other secret data from a company
Oct
30
comment How safe is it to use older/unknown Encryption methods for plaintext?
No, it's not safe. See this example.