30,782 reputation
757117
bio website raesene.github.io
location Scotland, United Kingdom
age 94
visits member for 4 years, 8 months
seen 2 hours ago

I'm an IT Security professional based in Scotland. I've been in IT Security for over x years now, with the last x-5 focusing on penetration testing/ethical hacking.

Currently a managing consultant with a large provider of security testing services.

Any opinions expressed here are purely my own and not necessarily those of my employer.


1d
comment Can data be forensically retrieved off an encrypted hard drive?
you may want to clarify your answer then, you don't make reference to "if the user has the password" and it could make people think that you were saying that it was possible to break the encryption itself, instead of just decrypting it using the correct key.
1d
comment Persistent XSS in Blogger domain
a problem with this is how can you have a blogging platform that doesn't allow people to create content in their blogs? If a user can create content , they can create redirections... Most/all blogging platforms I've seen would allow users (on their own blogs) to upload rich content (flash/Javascript etc)
Jul
28
comment How exactly does the Stagefright Vulnerability work on Android?
It's especially worth noting that the person committing those changes is the person who disclosed the vulns, so it's a fair bet this is it...
Jul
28
comment Filtered ports - What exactly filters them?
it's important to note that in nmap parlance "filtered" really means "I received no response", if you disable discovery you could have all filtered ports just 'cause there's nothing on that IP address at all...
Jul
28
comment How can common users defend against the StageFright vulnerability?
@Purefan I'd agree that they should have, unfortunately as this goes back to Android 2.2 and some handset manufacturers drop support for devices in a year (or even less) I'm afraid that a lot of handsets will be permanently vulnerable to this issue...
Jul
28
comment How can common users defend against the StageFright vulnerability?
This is a good answer, but perhaps worth noting that MMS is just the main vector for exploitation that's been noted so far. the problem with this issue is that it's in an underlying lib. that may be used in a variety of apps, so without patching the lib itself there is always the risk that it'll pop back up in another program...
Jul
28
comment How can common users defend against the StageFright vulnerability?
I'm guessing an answer of "Use iOS or Windows phone" isn't what you're looking for here :op
Jul
26
comment Some good resources to learn about Javascript DoM based Cross site scripting?
security.stackexchange.com/questions/51994/… may provide you with some information
Jul
20
comment Securing web applications with only a reverse proxy
AKA "Warm Smartie (or M&M if you're in the US) Security"
Jul
19
comment Help verifying downloaded Kali image
FWIW, you can also use the Get-Filehash powershell cmdlet for this technet.microsoft.com/en-us/library/dn520872.aspx
Jul
18
comment Sqlmap parameter “might not be injectable”
first up, are you authorised to test the security of this system? If not, you shouldn't be running SQLmap against it. If you are, then I would recommend testing without the WAF in place.
Jul
16
comment Prevent brute force attacks on web publishing logins
that was why I opened with the bit about it depending on the level of access. If you have no control over the server or firewall configuration and the service provider doesn't provide any features that could be used for this, it's hard to see what you could do (i.e. you have no access, you can't change the service) apart from have good passwords.
Jul
16
comment How to encrypt columns in a database and be able to easily change encryption key
you might get better answers if you give a little more background on what the "security reasons" are for changing the key every two months. In that time assuming you're using something like 128-bit AES there's no chance of a brute-force, and if you're concerned about the key being compromised, then there may be alternate counter measures that would be more effective...
Jul
16
comment Is this idea for a password manager secure? If so, why doesn't anybody use it?
Of course salting would help, but it removes the benefit that was referred to in the Question where if the person went to a public computer they would be able to calculate their password just knowing their master password
Jul
15
comment How to isolate persistent pop-up browser hijack
FWIW, "Take off and nuke it from orbit" is a meme used to indicate that in general once malware has become resident on a machine, the only viable solution is to reinstall the system from known good installation media. The reason for this is that much malware uses rootkits and other techniques to evade A-V and other common removal mechanisms, so especially when commenting in the abstract (i.e. we can't see the system in question) that is the best advice to provide.
Jul
10
comment New SSL certificate not being trusted on all clients
If you're looking for good answers to this question, I'd recommend providing a bit more information. 1) what error exactly is being shown on the clients that aren't working 2) how do the GPOs implement the block on non-company owned sites (i.e. do they look at the CN of the cert, do they look at some other field in the cert etc)
Jul
4
comment Supply chain risks
well if you outsource services to another company, the code developed by the outsourcing company and their IT security practices are a risk to your company. For example if an outsourcing company has poor security practices then if they have an incident, it would affect the security of your data.
Jul
1
comment How can I use the free version of Burp to identify input HTTP urls for my site
yeah what you want is (AFAIK) not available in the free version of burp but is available in the paid for version (engagement tools --> analyse site) which comes up with a list of GET/POST requests and the parameters they take. Whilst I don't know that it explictly handles this case if you want a free alternative I'd start with a look at OWASP ZAP if I were you
Jun
24
comment Finance with the multitude of “Secure Browsers”
you might want to be careful with Whitehat Aviator. Not sure on its current status but a couple of months back there were some issues... plus.google.com/+JustinSchuh/posts/69qw9wZVH8z
Jun
24
comment Is there a way to securely store unsalted passwords?
well we'll have to agree to differ here, I can't see a real world attacker bothering with that, when after they've got the main password list, just checking it against a list of common plaintext passwords (e.g. rockyou) would likely produce results far faster than brute-force cracking an scrypt hashed list of passwords with a site-wide salt.