466 reputation
27
bio website
location Redmond, WA
age
visits member for 3 years
seen yesterday

Jun
4
comment Monitoring user use VPN
Note that monitoring software could be something like adding a default, trusted root certificate that the company created, allowing them to act as a physical-network CA, meaning that the company can perform man-in-the-middle attacks. You'd need to have the correct certificate pre-loaded (and verify it wasn't replaced automatically).
May
26
comment Is this social engineering on facebook?
Yeah, somebody's up to something, that's obfuscated. I don't know enough to proceed easily myself, curious if somebody else here will do the honors.
May
26
comment Is this social engineering on facebook?
It's definitely some sort of social-engineering attack, yes. You're doing XSS to yourself... We'd need to see the code to know exactly what it would do, but I can guess that 1) It can likely trivially retrieve your username (not a terribly big deal, on its own), and 2) no, it's unlikely to be able to just grab your password, so long as you don't enter it again. It's possible that the given code has methods to persist over changes in the Facebook JavaScript code, so a simple logout may not be safe (you'd need to clear the browser cache).
May
26
comment Will my method for managing account data work?
Hashing emails would make it difficult for you to send emails to warn users that your db was stolen, and they need to change their password. Or notify them of maintenance. Or... You should probably concentrate on securing the registration/login page from harvesting attempts. You may need to provide more details about what you're doing with respect to IP logging.
May
26
comment How do I migrate users with shared email addresses to an email-based forgotten password process?
What, you can't keep it using the SMS option? A lot of people are starting to appreciate out-of-band options. Note that using the SMS option is really the only way to safely authenticate users in the shared-email case: send password reset, ask for username/mobile, send SMS code. Anything else is vulnerable to brute force or (worse) trivial guesses. How do you know the emails are "shared", and not that someone has multiple accounts?
May
25
answered Could a network host and process programs while securing against piracy?
May
25
comment Could a network host and process programs while securing against piracy?
@immibis - what sort of proof would you accept? A signed statement? Then you're back to square one (ie, that should likely be part of the general EULA). Some sort of compiler analysis? 1) If you're not compiling it, they can provide fake information (you'd have to compile it yourself to check) 2) Non-termination is impossible to prove in the general case, regardless. There isn't really a way to do this safely for monetary-related items.
May
22
comment WHOIS Contact Details Abused
I'd image changing the registration now wouldn't accomplish too much against your existing attackers - they already have your information (and might share it with others). To say nothing of it being cached by other systems. What sort of protection do you think WHOIS should be under? You're essentially posting it out in public, at which point it's (mostly) fair game. You can't complain about telemarketers for using a phone book to get your number (you can complain that they called you, under certain circumstances).
May
22
comment What is the security significance of Keyboard and Touchpad controller chips?
I'm assuming this was because the chips might have a buffer/cache of event data, which might end up including passwords/input data for PRNG seeding (or that those doing the destruction believed they might). These could be larger than I'm guessing, so they might include more data (or that it just takes less data to be useful).
May
21
comment Practical ways to prevent Denial Of Service attacks
The fact that it's being sourced via IP Spoofing is irrelevant (you're still under a DoS attack), and you probably can't immediately distinguish it from a regular DoS attack (where no IP spoofing takes place). Essentially, the attacker is mailing random people a return envelope for your company, which they then mail to you. Both they (and you) initially believe the communication is genuine; you have to deal with what you receive. It's only after a couple of rounds that the system can figure it out. And remember that you still receive legitimate requests during all this...
May
21
comment Practical ways to prevent Denial Of Service attacks
Moreover, what sort of attack do you think you need to protect against? Lying about an IP address is like sending somebody an envelope with a different return address on it; unless you can get into the destination mailbox (or are attempting to flood it with return mail), you have no idea if a response is even being sent. For that matter, the mailman might not even deliver your letter, if it thinks the return address is suspicious. From the view of the party who receives your letter, there usually isn't a way to distinguish it from legitimate ones.
May
21
comment Practical ways to prevent Denial Of Service attacks
Assuming I'm forging the IP headers, can't I forge the MAC calculations too? Because I'd be the source of the packet, right? Usually when you're protecting things from modification in-transit, there's a requirement of some shared secret between both parties (or knowledge of the results of the secret, for public/private keys).
May
4
comment How to stop password recovery attempts on accounts?
...how are they managing to change your passwords? Usually that requires a login (which would include your 2-factor auth). Now, I can imagine them going for the "forgotten password" process, but that doesn't usually change the password (just send a reset link to the email, which can usually be ignored).
May
2
comment How can I validate time-sensitive data is coming from a mobile app, and not being forged?
Yes, but that's the only thing you can do. If I can send a negative timestamp, I can send a (near) 0 duration one. Also, fun stuff - the user may not have control over the system clock, so it may get rolled backwards unintentionally (due to NTP). Now what?
May
2
comment How can I validate time-sensitive data is coming from a mobile app, and not being forged?
There's no way to secure this from a determined cheater - as you've noted, they can perform their own encryption. Heck, at that point they could supply their own timestamps; witness all the "high scores" for Angry Birds (or other games) in the iOS leaderboards. This also applies to estimating latency - you'd need a round trip to do this, which means waiting for the client to respond (see the problem there?). In short, nothing you can do will prevent people from submitting false information, the only thing to trust is your server. Duration is sending question to receiving answer.
May
2
comment How can I validate time-sensitive data is coming from a mobile app, and not being forged?
Er, there's one simpler way I have to defeat this: While answering the question, set the system clock backwards in time. Negative duration! Beyond that, you're still performing the encryption on the client, which is still outside of your control - the user can still access that to pass whatever timestamps they want. The harder you protect it, the more it tempts a certain crowd.
Apr
29
comment Securing remotely accessible IP cameras that do not support HTTPS
Sorry, it wasn't immediately clear to me that the cameras were able to attach using the secured network. Say, that most of your home network uses WPA2, but the cameras weren't really using it.... yeah, that's not too likely is it...
Apr
28
comment Securing remotely accessible IP cameras that do not support HTTPS
Are these wireless or wired cameras? If wireless, do the cameras support a wireless security protocol? Securing the data to the router doesn't do much good if you then broadcast it in the clear to the camera.
Apr
28
comment Can I determine a private key given the encrypted data and corresponding cleartext?
Thankfully, this is the case, or public/private key cryptography would be broken. In such a case, anyone sending a message could read all other messages. In the case of the one-time-pad, only a few people are given the key in the first place, so it's not an issue.
Apr
25
comment Could a network host and process programs while securing against piracy?
If you're distributing code in a network, you also have to worry about a malicious user changing output from a legitimate program. Or even from just general failures (ie, fandango on core, wonky calculations from overheating, etc). Which case is which would be impossible to prove without forensic-level examination. Essentially, you're asking for a decentralized version of Google's AppEngine or AWS, without any of the protections a trusted system would provide.