30,782 reputation
757117
bio website raesene.github.io
location Scotland, United Kingdom
age 94
visits member for 4 years, 8 months
seen 2 hours ago

I'm an IT Security professional based in Scotland. I've been in IT Security for over x years now, with the last x-5 focusing on penetration testing/ethical hacking.

Currently a managing consultant with a large provider of security testing services.

Any opinions expressed here are purely my own and not necessarily those of my employer.


1d
comment Can data be forensically retrieved off an encrypted hard drive?
you may want to clarify your answer then, you don't make reference to "if the user has the password" and it could make people think that you were saying that it was possible to break the encryption itself, instead of just decrypting it using the correct key.
1d
comment Persistent XSS in Blogger domain
a problem with this is how can you have a blogging platform that doesn't allow people to create content in their blogs? If a user can create content , they can create redirections... Most/all blogging platforms I've seen would allow users (on their own blogs) to upload rich content (flash/Javascript etc)
2d
answered How dangerous is it to use textmods from internet sources?
Jul
28
comment How exactly does the Stagefright Vulnerability work on Android?
It's especially worth noting that the person committing those changes is the person who disclosed the vulns, so it's a fair bet this is it...
Jul
28
answered NMAP DNS Resolution
Jul
28
answered Detect when I do brute force attack and block the connection
Jul
28
comment Filtered ports - What exactly filters them?
it's important to note that in nmap parlance "filtered" really means "I received no response", if you disable discovery you could have all filtered ports just 'cause there's nothing on that IP address at all...
Jul
28
reviewed Leave Closed Where to search for vulnerabilities in a WordPress theme?
Jul
28
reviewed Leave Open Writing an information security policy
Jul
28
reviewed Leave Open Is there a tool in Kali Linux that get Wi-Fi passwords only by capturing the traffic?
Jul
28
comment How can common users defend against the StageFright vulnerability?
@Purefan I'd agree that they should have, unfortunately as this goes back to Android 2.2 and some handset manufacturers drop support for devices in a year (or even less) I'm afraid that a lot of handsets will be permanently vulnerable to this issue...
Jul
28
comment How can common users defend against the StageFright vulnerability?
This is a good answer, but perhaps worth noting that MMS is just the main vector for exploitation that's been noted so far. the problem with this issue is that it's in an underlying lib. that may be used in a variety of apps, so without patching the lib itself there is always the risk that it'll pop back up in another program...
Jul
28
comment How can common users defend against the StageFright vulnerability?
I'm guessing an answer of "Use iOS or Windows phone" isn't what you're looking for here :op
Jul
28
answered Writing an information security policy
Jul
28
reviewed Close Server authentication during the SSL handshake
Jul
28
reviewed Leave Open Failure analysis to avoid locking permanently online accounts
Jul
26
comment Some good resources to learn about Javascript DoM based Cross site scripting?
security.stackexchange.com/questions/51994/… may provide you with some information
Jul
26
reviewed Leave Open Some good resources to learn about Javascript DoM based Cross site scripting?
Jul
26
reviewed Leave Open Books about theoretical basis in log management
Jul
24
awarded  Constituent