Rory McCune

14,195 reputation

22361

bio	website	scotsts.com
	location	Scotland, United Kingdom
	age	39
visits	member for	2 years, 6 months
	seen	3 hours ago
stats	profile views	513

I'm an IT Security professional based in Scotland. I've been in IT Security for over 13 years now, with the last eight focusing on penetration testing/ethical hacking.

Currently director at a Scotland based Security Testing consultancy called ScotSTS

	14,195 reputation	bio	website	scotsts.com	visits	member for	2 years, 6 months
22361 badges		location	Scotland, United Kingdom		seen	3 hours ago

summary answers questions tags badges favorites bounties reputation activity

134 Comments

suggestions reviews revisions comments badges posts accepts all

1d	comment	Trying to firewall ports 1863, 5190 So that indicates that the ports are open but that nmap can't identify the service running on them. Did netstat -tunap show anything useful?
1d	comment	Plain Text Password Reset Vulnerability @AbsoluteƵERØ reading that article, two points 1) you're mixing terms I'm talking about one time passwords in the sense that OP used it not in the sense of google authenticator, second whilst that article has a rather inflammatory title, if you read the text of it, it says that google authenticator style OTP is a lot better than any single factor solution (e.g. anything that is just username/password)
May 15	comment	Security test lab setup Well the idea is that you can probably do it with one physical machine (although more are always useful). You can run (for example) windows + VMWare workstation and then create various VMs for tools and target vulnerable systems. the main restriction on how many you can have running is system memory. with 16GB of RAM I commonly have 3-4 VMs running at the same time without causing a slowdown.
May 8	comment	Whats a secure firewall rules using UFW? so it sounds like you have some opportunities for hardening. for SSH you could restrict it to your own IP (if you have a static at home) or your ISPs netblock otherwise. 9939 presumably there's a specific host that connects to you to do the backup? if so you could use the firewall to lock that down to just that IP address. if you're using varnish as as reverse proxy do customers just connect to that on 80? in which case perhaps you can lock down the source addresses for 8080. locking down 25 depends on whether it's an MX for a domain or if it only receives mail from specific hosts...
Apr 22	comment	“Please Enter Nth Character” without HSM From what I've seen the only realistic implementation of choose x from y is symmetric encryption, and in most online scenarios the only way to achieve that without exposing the key somewhere on a server is to use an HSM.
Apr 19	comment	Are there any free static analysis tools for C# / .NET code CAT.NET is interesting, but unfortunately it's not (AFAIK) maintained and there haven't been any updates in the last couple of years.
Apr 17	comment	How do random attackers discover websites to target? well there's the standard "scanning port 80 on a range of IP addresses", but I'd say that direct scanning, search engine invclusion (e.g. shodan) and accidental leakage of information on the site would be the main 3
Apr 14	comment	Vulnerable code suggested on OWASP? @luc I've changed this on the OWASP site, does the updated version look ok to you?
Apr 14	comment	Vulnerable code suggested on OWASP? yep I saw your answer on that front, interesting. suggested edit was just to remove potential confusion over the term "IP spoofing"
Apr 14	comment	Vulnerable code suggested on OWASP? Do you mean IP spoofing in the traditional sense (i.e. attacker starts a session with the server pretending to be another machine?) If so, then that's very unlikely to be successful over the Internet unless the attacker can use source routing (very unlikely) or the server has predictable TCP sequence numbers (extremely unlikely). If it's not that then you might want to update the question.
Apr 12	comment	Should web sites disable form autocomplete on all forms? @giles on keyloggers my point was more that it's a different class of attackers (a rarer one) that would go to the lengths of keyloggers compared to just re-using a cached password. Also with keyloggers the attacker runs the risk that anti-malware software will detect whereas there's no risk of that with finding a cached password
Apr 12	comment	Should web sites disable form autocomplete on all forms? @Gilles well I've seen "remember me" style functionality on quite a few sites. They provide a check-box on the login page which if ticked sets a long expiry cookie on the PC. When the user re-visits that site it detects the cookie, checks the value and if valid automatically logs the user in. This has the same effect as remembering the password, without actually storing the password on the client-side. The token is still dangerous but it can more easily be expired when compared to the user password, so I'd say a better solution for stopping users having to type their passwords in a lot..
Apr 10	comment	Should web sites disable form autocomplete on all forms? Also for shared browsers the threat scenario of "user finds another users password cached in browser and decides to use it" is very different in terms of attacker skill and motivation to "user installs keylogging software on PC"
Apr 10	comment	Should web sites disable form autocomplete on all forms? I don't really agree with your reasoning here. If you want users to have a "remember me" function to help users choose strong passwords (and not really sure that would have the desired effect anyway) then the application should implement it itself and not rely on browser mechanisms. The problem with browser based ones is that they store the actual password where an properly implemented remember me function can store a token and try to tie it to a specific machine/IP address making it harder to steal.
Apr 8	comment	Man-in-the-middle Blue coat proxy ssl or what? Might be better to say "your employer may have a right to perform a MITM on you depending on local laws in your jurisdiction and the contract you signed when you joined the organisation"
Apr 4	comment	What are the security threats of zip file uploads and what preventive actions should be taken? @user1448660 well if you do no processing of the content whatsoever (inc. A-V scanning as ratchet-freak says) then it wouldn't seem to me that zip files would be any different from a risk perspective to any other downloadable file type.
Apr 4	comment	I have a client that is worried about DDOS attacks on their site, and they want penetration testing. Will that help? sure some ISPs and some levels of DDoS attack, it's all relative. If you look at the recent ones that Spamhaus got, it seemed from that articles that any one ISP would have trouble handling that.
Apr 4	comment	How exactly does Burp Sequencer calculate the values it derives? In case it's of interest there's some more discussion on this on the Burp Forum here forum.portswigger.net/…
Mar 27	comment	Security measures for a WiFi access point? A couple of things to note on this. MAC filtering can be useful as a protection for non-technical users, but it's trivial for a tech-savvy person to change the MAC address of PC, so don't rely on it. Also on broadcasting it's worth noting that this is a security trade-off, if you turn of broadcasting the clients will have to use directed probes to find the network, which can leave them more open to spoofing attacks. Also a lot of wardrivers will use something like kismet which can pick-up non-broadcasting networks if there's any traffic on them.
Mar 18	comment	How would one crack a weak but unknown encryption protocol? If you're looking for responses related to Cryptanalysis you might want to specify a couple of additional pieces of information. Firstly, how many cipher texts would the attacker have access to, secondly how many ciphertexts would the attacker have access to and thirdly what type of data is encrypted by the ciphertext (e.g. is it binary data or text).