25,453 reputation
34197
bio website scotsts.com
location Scotland, United Kingdom
age 40
visits member for 3 years, 8 months
seen 39 mins ago

I'm an IT Security professional based in Scotland. I've been in IT Security for over x years now, with the last x-5 focusing on penetration testing/ethical hacking.

Currently director at a Scotland based Security Testing consultancy called ScotSTS


Jul
20
comment Is there a repository of credentials used in training materials/samples and SDKs?
I'm not aware of a specific repo. for this, but to be honest googling <product or SDK name> default credentials generally does the job just fine...
Jul
6
comment Cannot get access into a vulnerable Windows 2000 (MS03_026)
@yzT Assuming that you've got access to the machine at an OS level, if you haven't already, I'd try rebooting it before retrying the exploit. In some cases I've seen exploits that will only work once as they leave the vulnerable service in a hung/crashed state.
Jun
19
comment Are there any exploits in Movable Type that allow the attacker to delete the movable type files?
you might want to have a look at this movabletype.org/news/2014/05/securing_movable_type.html recent blog post from movable type about securing an installation...
Jun
17
comment Should websites be allowed to disable autocomplete on forms or fields?
@Manishearth sure in an ideal world but the reality is that sites do this for all sorts, I had one today do it for Debit card expiry dates and CVV numbers..
Jun
16
comment Tools to test all-around hardness of a Unix installation?
@kjo as another option to OpenVAS you could look at Nessus, there's a free version for non-profit use and a commercial option which has some pretty good security auditing features.
Jun
16
comment Should websites be allowed to disable autocomplete on forms or fields?
@Manishearth I'd guess that the problem lies where sites are using password type fields for secondary secrets. I have seen this behaviour ins some cases...
Jun
10
comment How do you capture ALL the traffic from an Android app?
you might find that the application is using certificate pinning ( more info security.stackexchange.com/questions/29988/…), which would mean that traffic interception would be tricky. If that's the case you may have more luck de-compiling the app and approaching the review that way...
Jun
8
comment Checking if a server is compromised
you might want to look at this serverfault.com/questions/218005/…
Jun
4
comment Can users make use of a password manager when banks tell them never to write passwords down?
@d-w from what I've seen wording varies but some examples of what paj is talking about from halifax.co.uk/aboutonline/security/protect-yourself "Never let your passwords be known to anyone and don't write them down". From santander.co.uk/csgs/… "Keep your personal Passcode and Registration number safe, and avoid writing them down"
May
30
comment If a Windows laptop with an encrypted hard disk is stolen, can the contents be accessed by a professional hacker?
@kasperd I wasn't thinking of this as an either encryption or password situation, but the idea that the encryption key can be held in tamper resistant form and only be accessed via that hardware is quite well established and as harry-johnston says protecting a key is easier than protecting all the data
May
29
comment If a Windows laptop with an encrypted hard disk is stolen, can the contents be accessed by a professional hacker?
@kasperd well if you look at a solution where the keys are held in hardware and password guessing has to be done through that hardware, then that hardware can enforce the lockout...
May
29
comment Is it good practice to ban an IP address if too many login attempts are made from it?
@voo yeah I'm aware of TCP sequence predication but that hasn't been a practical threat in ages, that said I hadn't seen that CVE before, but from reading the mailing list posts they're still talking about 24-bits of randomness which would be a hell of a lot of packets to make a single HTTP request even with a vulnerable system.
May
28
comment Best practices concerning pushing user registrations
If you're looking for existing software which addresses this problem, you may want to mention what language and framework you're using and also you may get a better response somewhere like stackoverflow as it's more a software question than a security one at that point..
May
28
comment Is it good practice to ban an IP address if too many login attempts are made from it?
@voo I'd agree with Lucas, you'll need to provide more details to substantiate that claim. Spoofing IP addresses for TCP based protocols (e.g. HTTP) is quite difficult in most cases.
May
26
comment Cisco/Juniper IOS hacking?
There's a lot of material on this on-line, and it's safe to say it's not a trivial task. I'd recommend that you start with looking up Felix 'FX' Lindner pages like phenoelit.org/stuff/papers.html have some good references to starting with that kind of stuff...
May
10
comment Testing Basic Authentication with ncrack
just in case you copy paste that command line, you did realise you've missed the leading h off the URL?
May
6
comment How could an attacker have gained remote access to my laptop?
or potentially provide her with a wide array of new techniques to use to cause havoc :)
May
5
comment Detecting code source variants of the same function
@begueradj a common technique used by malware to bypass A-V is to modify the look of existing code with packers, so to a large extent A-V signatures don't scan successfully :)
May
3
comment I've found security vulnerability in current linux distribution. What next?
I'd agree with @SPRBRN on this, report it to Ubuntu in the first instance and provide as much info. as you can on the vuln. If they don't respond then you can look at other avenues (developer of the service, CERT, Full Disclosure, etc)
May
3
comment I've found security vulnerability in current linux distribution. What next?
good lord people get your facts straight before commenting heartbleed is based on the OpenSSL version and whilst some 1.0.1 versions are affected, others are not. From a brief google it would appear that @Emski is correct April 7 or later builds are not vulnerable (not to say that this server wasn't vulnerable at any point in time of course) Either way Heartbleed in the general case is a memory leak not something that would provide immediate shell access to the server...