476 reputation
27
bio website
location Redmond, WA
age
visits member for 3 years, 1 month
seen 12 hours ago

Jun
16
comment how can I tell if I'm under IMSI cell phone surveillance
@JulianKnight - sure, these devices are all over the place. What I'm getting at, though, is that this person has already been arrested, and some of his property confiscated; the police probably have enough to get a warrant for data from the cell companies. If they don't have one, anything such a device collects could (maybe, talk to lawyer) be thrown out - at minimum, the ACLU would love such a case. So the use of the device is really secondary here...
Jun
15
comment how can I tell if I'm under IMSI cell phone surveillance
They'd have to be bored to be sitting outside your apartment with something to pick up your calls. Remember, the mobile phone is connecting through a network, just like a wired phone. The government doesn't bother going to the endpoint, they just have the central network give it to them. They might be having the network ping the number for data locations more often (or possibly driving by some of the time) to verify your (phone's) location, but I'd start with the device just being faulty. Unless somebody may have hired a PI too?
Jun
15
comment how can I tell if I'm under IMSI cell phone surveillance
Also, the app doesn't appear complete, so I'm not sure how helpful that would be.
Jun
14
comment Help with successful Internal intrusions
Moreover, even on most embedded solutions, memory address locations aren't (usually) going to stay the same (essentially to prevent behavior related to this) between application/machine start. So the information would be largely useless anyways. I agree with pfyon - you need to have him document his work, if for no other reason so as to enable you to close the gaps.
Jun
10
comment HTTPS still NSA-safe?
https is itself a protocol, which can choose from one of a number of different algorithms, some of which are already known to be broken. Which one to use is negotiated between the server and the client, so if they pick a known broken one...
Jun
7
comment copy protection (or licensing) mechanism for an android app
... there might be a problem with that - some tablets/phones likely don't allow such sideloading without developer accounts. Also, if the device is on contract, they may get it replaced - which would be a major problem if you do device locking. Note that doing it this way would require an unusual install path - you have to tell the OS to install from an untrusted source (look for instructions online), which people are often leery to do, for obvious reasons. It appears the store has built-in licensing, too...
Jun
7
comment copy protection (or licensing) mechanism for an android app
... If it's present on the client device, it's findable. You'd be better off to do something with a public/private key hash, thus no secret value to find. In fact, doing it in this fashion is likely more noticeable, because of the checks and success/failure. In the case of IM apps, they're usually talking to a server to pass messages, so can simply refuse requests from unregistered accounts. Heck, if you're using something this simple, I'd just dummy out the method call - normally these verifications have to be spread throughout the client code.
Jun
7
comment copy protection (or licensing) mechanism for an android app
Out of curiosity, why aren't you distributing through a regular store? Traditionally, it's not the "common" end users (those without the necessary ability) you actually have to worry about, it's the bored people who do. These people aren't even necessarily your target audience! Low price and a simple/quick/easy registration process (combined with an app that doesn't react adversely) are your best defense against these people. I'd actually advise against a machine-locking scheme, especially with something like an android tablet, unless you have a simple way to switch legitimate machines.
Jun
5
comment Will my method for managing account data work?
There are existing solutions for that, some free, for most/all existing servers (or as a purchasable piece of hardware). Your current idea is a good naïve first solution - it'll stop/slow basic attacks, but determined attackers have better tools, including running distributed (using multiple connections). Depending on the network, even multiple legitimate users may appear to be coming from the same IP (through NAT). Many ISP issue dynamic IPs to consumers, which are often changed if the connection to the modem drops. See if existing solutions work for you first.
Jun
4
comment Monitoring user use VPN
Or install a trusted certificate they created, allowing them to act as a root CA on their physical network; this would allow them to perform man-in-the-middle attacks trivially...
Jun
4
comment Monitoring user use VPN
Note that monitoring software could be something like adding a default, trusted root certificate that the company created, allowing them to act as a physical-network CA, meaning that the company can perform man-in-the-middle attacks. You'd need to have the correct certificate pre-loaded (and verify it wasn't replaced automatically).
May
26
comment Is this social engineering on facebook?
Yeah, somebody's up to something, that's obfuscated. I don't know enough to proceed easily myself, curious if somebody else here will do the honors.
May
26
comment Is this social engineering on facebook?
It's definitely some sort of social-engineering attack, yes. You're doing XSS to yourself... We'd need to see the code to know exactly what it would do, but I can guess that 1) It can likely trivially retrieve your username (not a terribly big deal, on its own), and 2) no, it's unlikely to be able to just grab your password, so long as you don't enter it again. It's possible that the given code has methods to persist over changes in the Facebook JavaScript code, so a simple logout may not be safe (you'd need to clear the browser cache).
May
26
comment Will my method for managing account data work?
Hashing emails would make it difficult for you to send emails to warn users that your db was stolen, and they need to change their password. Or notify them of maintenance. Or... You should probably concentrate on securing the registration/login page from harvesting attempts. You may need to provide more details about what you're doing with respect to IP logging.
May
26
comment How do I migrate users with shared email addresses to an email-based forgotten password process?
What, you can't keep it using the SMS option? A lot of people are starting to appreciate out-of-band options. Note that using the SMS option is really the only way to safely authenticate users in the shared-email case: send password reset, ask for username/mobile, send SMS code. Anything else is vulnerable to brute force or (worse) trivial guesses. How do you know the emails are "shared", and not that someone has multiple accounts?
May
25
answered Could a network host and process programs while securing against piracy?
May
25
comment Could a network host and process programs while securing against piracy?
@immibis - what sort of proof would you accept? A signed statement? Then you're back to square one (ie, that should likely be part of the general EULA). Some sort of compiler analysis? 1) If you're not compiling it, they can provide fake information (you'd have to compile it yourself to check) 2) Non-termination is impossible to prove in the general case, regardless. There isn't really a way to do this safely for monetary-related items.
May
22
comment WHOIS Contact Details Abused
I'd image changing the registration now wouldn't accomplish too much against your existing attackers - they already have your information (and might share it with others). To say nothing of it being cached by other systems. What sort of protection do you think WHOIS should be under? You're essentially posting it out in public, at which point it's (mostly) fair game. You can't complain about telemarketers for using a phone book to get your number (you can complain that they called you, under certain circumstances).
May
22
comment What is the security significance of Keyboard and Touchpad controller chips?
I'm assuming this was because the chips might have a buffer/cache of event data, which might end up including passwords/input data for PRNG seeding (or that those doing the destruction believed they might). These could be larger than I'm guessing, so they might include more data (or that it just takes less data to be useful).
May
21
comment Practical ways to prevent Denial Of Service attacks
The fact that it's being sourced via IP Spoofing is irrelevant (you're still under a DoS attack), and you probably can't immediately distinguish it from a regular DoS attack (where no IP spoofing takes place). Essentially, the attacker is mailing random people a return envelope for your company, which they then mail to you. Both they (and you) initially believe the communication is genuine; you have to deal with what you receive. It's only after a couple of rounds that the system can figure it out. And remember that you still receive legitimate requests during all this...