486 reputation
27
bio website
location Redmond, WA
age
visits member for 3 years, 10 months
seen 7 hours ago

May
25
comment Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial?
@SteveDL - the reason I didn't post it as an answer was because this seemed to be more about the practice of erasure, especially for potentially historical reasons. It also wouldn't help him now, if his data is already written, because old sectors and scratch files wouldn't be encrypted unless done from the start. An existing answer mentioning it in an addendum on new best practice would probably be better.
May
24
comment Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial?
As usual, an ounce of prevention is worth a pound of cure: if you encrypted the drive before use, all you'd need do is throw away the key, rendering the drive unreadable.
May
17
comment what is today allowed, when I travel to USA?
...home computers weren't really a thing in the 80s, so it's likely all PC users were scrutinized (nothing special about UNIX, especially with all the random different OSes that were available). You'd probably have more trouble getting certain things out, although very little would be consumer hardware (nowadays). What is it you're worried about?
Apr
28
comment Malware script uploaded - CPU has been maxed out
1 - keyloggers are considered output of script-kiddies and other amateurs (there are tools to create/deploy them). 2 - Only truly boneheaded programs store saved passwords in the clear, everything else encrypts them to prevent compromise (either from viruses, or opportunistic users). For that matter, most OSs provide an API for such protected storage anyways. If you have the ability to get the stored passwords, you could probably do anything you want.
Apr
28
comment Malware script uploaded - CPU has been maxed out
Absolutely false. Any of the following are possible: Malware sniffs credentials at authentication time (keylogger for passwords) and exfiltrates them, silently adds relevant file/command to stack, malware installs new root certificate/DNS redirect allowing for MITM, prevent the close of the SSH connection and keep using it. The only thing not storing the credentials does is prevent them from being compromised until they're used. Otherwise, anything goes; anything the client machine can do with a person behind it, a rogue process can do too.
Apr
28
comment Malware script uploaded - CPU has been maxed out
SSH would only prevent the connection being snooped from outside (and that's the reason you should use it), but still wouldn't protect against on-machine compromise.
Apr
28
comment Malware script uploaded - CPU has been maxed out
...if his computer is compromised, it doesn't matter if he stores passwords or not, they could be sniffed at type-time (granted, its easier for some attacks, but not really necessary). It would also be possible for any such Trojan to simply upload a kill-script itself.
Apr
12
comment Hidden Malware on a windows OS able to startup
...You could check Amazon. Why do you want to know, exactly? If you're wanting to defend against this kind of thing, your best options are generally: 1) Don't use an admin account (and be careful with UAC-type prompts), 2) Be careful where you go on the internet, 3) Keep your OS up-to-date, and 4) don't plug unknown USB drives into your machine. Generally, the basic protections of an up-to-date OS will do an adequate job of protecting you, so long as no overly facepalm-worthy actions are taken. Anything capable of bypassing them is likely getting in anyways...
Apr
12
comment Hidden Malware on a windows OS able to startup
Well, first you have to get to it. You could always install something while physically present. Otherwise, you have to do it remotely, which means you either need to 1) attack the hardware of the machine (ie, perhaps the network card doesn't properly sanitize all input), or 2) Write regular malware to modify the bootloader/etc. note: if you can get this to run at all, you can probably do whatever you want without going that far. Getting lower is about staying undetected (and opening up more possibilities).
Apr
12
comment Hidden Malware on a windows OS able to startup
A really good hacker modifies the bootloader (the program that starts Windows when you turn the computer on). This would bypass all AV programs, because it would start before the OS and everything else. Microsoft knows this, though, which is one of the (Stated) reasons for UEFI and other secure BIOS bootloaders. Hackers have responded by pushing malware down into hardware. Otherwise... you don't have to register yourself as a service, just co-opt somebody else (by, say, modifying some other service to start you up). Most of the easy stuff is well understood and defended against, now.
Apr
11
comment Copy protection in SD cards
If you load it to the device, you'd have to erase it from the card (or they could load it into a different device)
Apr
10
comment Copy protection in SD cards
Hunh, didn't know about that feature, good find. Of course, then he still has some other problems: 1) has to purchase and implement an encryption license. 2) Limited in what GPS devices can be used, and potentially who is willing to work with you. 3) Required to read from SD card (can't permanently load to device) 4) Have to sell/ship (potentially unique) physical goods. A cursory check shows at least Garmin to be using this feature, dunno about any other company
Apr
9
comment Copy protection in SD cards
Of data? Of some common, open format? Practically impossible. The way you protect data (temporarily) is by using a proprietary format, and creating your own programs or hardware to run it (you get better results if you make the hardware). For non-connected devices (ie, standard GPS receivers) there's nothing you could conceivably do to prevent people sharing some sort of unlock key. Who provides the card? What happens if somebody gets a new GPS unit, are they supposed to buy a new copy of your map?
Mar
17
comment Why Disallow Special Characters In a Password?
Since it's actually easier to increase security by increasing the length of the password, somebody is fooling themself. The kind of people likely to use special characters are probably less likely to forget them, too...
Mar
7
comment Is accidental credit card fraud possible?
Also, usually there's other data on the card that would have to be corrupted - expiration data, CCV, name... It's vanishingly likely that would be randomly corrupted into your data.
Mar
7
comment How to check randomness of random number generators?
The real problem with using samples in this case is likely to be the hardware - you need a lot of values, so have to spend time getting them. If the smart card is throttled (likely, for a couple of reasons), you may not be able to get enough samples to tell in a reasonable timeframe.
Jan
25
comment Strong email validation. Is it really necessary?
What's going out in the validation message? Could people try to use it for spam/covertly pass messages/who knows?
Jan
25
comment Fake Microsoft Security Department
...given the likelihood this guy's calling from another state (or even another country), I think it can get kicked up to the FBI for wire fraud. Of course, there's two major problems here: 1) There's entirely too many instances of this, so it's unlikely to have anything come of this specific case 2) If they're out of the country, you're pretty much out of luck. Both of those presume they can even find the guy, which isn't terribly likely either, usually.
Dec
2
comment What prevents “money card” (offline smartcard system) from getting duplicated for payment fraud?
Okay, sorry, I thought that you were referring to bank cards, where it was your bank balance that was saved. In that case, absolutely not (the card wouldn't know about online transactions, for example). Otherwise, yes, the card is loaded with money, and the crypto capabilities prevent tampering. This is effectively holding cash, just stored on a card. The system may not even keep track of the balance on each card, just aggregate transaction amounts for each register. No terminal maintains a db of all balances on all cards, only maybe what it's processed.
Dec
2
comment What prevents “money card” (offline smartcard system) from getting duplicated for payment fraud?
You don't store the balance on the card itself, for exactly that reason. These cards have encryption capabilities to help prevent fraud by stealing the card, but this is generally to protect individual consumers, not processors. Terminals that process Debit transactions almost always are hooked up with a realtime connection (to an ACH or the bank itself), specifically to mitigate these types of attacks - on older systems, this was the only way to verify the pin! Used for Credit they might not be, but you'd still be on the hook, so...