486 reputation
27
bio website
location Redmond, WA
age
visits member for 3 years, 9 months
seen 2 days ago

Apr
12
comment Hidden Malware on a windows OS able to startup
...You could check Amazon. Why do you want to know, exactly? If you're wanting to defend against this kind of thing, your best options are generally: 1) Don't use an admin account (and be careful with UAC-type prompts), 2) Be careful where you go on the internet, 3) Keep your OS up-to-date, and 4) don't plug unknown USB drives into your machine. Generally, the basic protections of an up-to-date OS will do an adequate job of protecting you, so long as no overly facepalm-worthy actions are taken. Anything capable of bypassing them is likely getting in anyways...
Apr
12
comment Hidden Malware on a windows OS able to startup
Well, first you have to get to it. You could always install something while physically present. Otherwise, you have to do it remotely, which means you either need to 1) attack the hardware of the machine (ie, perhaps the network card doesn't properly sanitize all input), or 2) Write regular malware to modify the bootloader/etc. note: if you can get this to run at all, you can probably do whatever you want without going that far. Getting lower is about staying undetected (and opening up more possibilities).
Apr
12
comment Hidden Malware on a windows OS able to startup
A really good hacker modifies the bootloader (the program that starts Windows when you turn the computer on). This would bypass all AV programs, because it would start before the OS and everything else. Microsoft knows this, though, which is one of the (Stated) reasons for UEFI and other secure BIOS bootloaders. Hackers have responded by pushing malware down into hardware. Otherwise... you don't have to register yourself as a service, just co-opt somebody else (by, say, modifying some other service to start you up). Most of the easy stuff is well understood and defended against, now.
Apr
11
comment Copy protection in SD cards
If you load it to the device, you'd have to erase it from the card (or they could load it into a different device)
Apr
10
comment Copy protection in SD cards
Hunh, didn't know about that feature, good find. Of course, then he still has some other problems: 1) has to purchase and implement an encryption license. 2) Limited in what GPS devices can be used, and potentially who is willing to work with you. 3) Required to read from SD card (can't permanently load to device) 4) Have to sell/ship (potentially unique) physical goods. A cursory check shows at least Garmin to be using this feature, dunno about any other company
Apr
9
comment Copy protection in SD cards
Of data? Of some common, open format? Practically impossible. The way you protect data (temporarily) is by using a proprietary format, and creating your own programs or hardware to run it (you get better results if you make the hardware). For non-connected devices (ie, standard GPS receivers) there's nothing you could conceivably do to prevent people sharing some sort of unlock key. Who provides the card? What happens if somebody gets a new GPS unit, are they supposed to buy a new copy of your map?
Mar
17
comment Why Disallow Special Characters In a Password?
Since it's actually easier to increase security by increasing the length of the password, somebody is fooling themself. The kind of people likely to use special characters are probably less likely to forget them, too...
Mar
7
comment Is accidental credit card fraud possible?
Also, usually there's other data on the card that would have to be corrupted - expiration data, CCV, name... It's vanishingly likely that would be randomly corrupted into your data.
Mar
7
comment How to check randomness of random number generators?
The real problem with using samples in this case is likely to be the hardware - you need a lot of values, so have to spend time getting them. If the smart card is throttled (likely, for a couple of reasons), you may not be able to get enough samples to tell in a reasonable timeframe.
Jan
25
comment Strong email validation. Is it really necessary?
What's going out in the validation message? Could people try to use it for spam/covertly pass messages/who knows?
Jan
25
comment Fake Microsoft Security Department
...given the likelihood this guy's calling from another state (or even another country), I think it can get kicked up to the FBI for wire fraud. Of course, there's two major problems here: 1) There's entirely too many instances of this, so it's unlikely to have anything come of this specific case 2) If they're out of the country, you're pretty much out of luck. Both of those presume they can even find the guy, which isn't terribly likely either, usually.
Dec
2
comment What prevents “money card” (offline smartcard system) from getting duplicated for payment fraud?
Okay, sorry, I thought that you were referring to bank cards, where it was your bank balance that was saved. In that case, absolutely not (the card wouldn't know about online transactions, for example). Otherwise, yes, the card is loaded with money, and the crypto capabilities prevent tampering. This is effectively holding cash, just stored on a card. The system may not even keep track of the balance on each card, just aggregate transaction amounts for each register. No terminal maintains a db of all balances on all cards, only maybe what it's processed.
Dec
2
comment What prevents “money card” (offline smartcard system) from getting duplicated for payment fraud?
You don't store the balance on the card itself, for exactly that reason. These cards have encryption capabilities to help prevent fraud by stealing the card, but this is generally to protect individual consumers, not processors. Terminals that process Debit transactions almost always are hooked up with a realtime connection (to an ACH or the bank itself), specifically to mitigate these types of attacks - on older systems, this was the only way to verify the pin! Used for Credit they might not be, but you'd still be on the hook, so...
Dec
1
comment Can bankers' rounding be exploited to maliciously increase balances?
@Falco - Hrm, you're right. Seems I misread it. (<is now trying to figure out why he first thought that>)
Nov
29
comment Secure private key storage
In that case, you'd still be plugging a compromised USB drive into your machine - badusb itself isn't a requirement. So existing attacks should still work just fine (ie, Stuxnext didn't need it to do its work). badusb is really more about how firmware isn't properly protected, meaning you have some extra ways to hide/attack... but you still have to hit the USB key in the first place.
Nov
29
comment Techniques to make a login page safe without using SSL
Stealing a login is the least they could do. MiTM means they can do just about anything - replace the data sent to your server, replace the data coming from your server... if you leak the Facebook login somehow I imagine people will be very annoyed with you. For your number 3, you're probably sending things as a GET request instead of a POST request (which you're not supposed to do for exactly this reason).
Nov
25
comment Can a lock picker slowly undermine the security of a deadbolt door?
Forget being defeated through lockpicking, if I considered the information valuable enough I'd just buy (make?) a batch of explosives. Or, depending on the door, a chainsaw. It'd be really obvious (and likely to alert somebody), but ideally I could just grab the machine and run within a minute.
Nov
4
comment OpenVPN detection
@greasemonkey - That question was asked a week ago. Why are you asking? One major factor in using VPNs is to disguise the origin location, both from the ultimate destination and anybody else snooping on the line - if you could detect the true location it would defeat the purpose. Further, just knowing that something is running a VPN service isn't necessarily enough to tell you that a given connection is using the service, vs coming from the computer running the VPN itself.
Oct
31
comment Can anyone be hacked?
If they just want some information from you, attacks can be as little as $5. As usual, the weakest element of the security chain isn't the technology, it's the humans around it.
Oct
31
comment What stops a developer from accessing credit card details and other secret data from a company
@AyeshK - Depending on the amounts involved, and how much it would cost to implement/for compliance/in the case of breaches, you may have better luck using one of the existing payment processors (like PayPal or Amazon's). They manage all this stuff for you, for a fee. Dealing with stuff of this nature is non-trivial, and people are becoming more wary (given the number of breaches occurring).