23,585 reputation
33591
bio website scotsts.com
location Scotland, United Kingdom
age 40
visits member for 3 years, 5 months
seen 19 hours ago

I'm an IT Security professional based in Scotland. I've been in IT Security for over 13 years now, with the last eight focusing on penetration testing/ethical hacking.

Currently director at a Scotland based Security Testing consultancy called ScotSTS


2d
comment -bash: -sudo: command not found
@thisisjnd no worries, a q. would be which version of linux are you using? If it's fedora based it would be yum that you're looking for rather than apt-get...
2d
comment -bash: -sudo: command not found
This may not be the best site to ask, as it's more a question of unix paths and package management. probably a better fit for unix.stackexchange.com or askubuntu.com
Apr
10
comment Doesn't the Heart Bleed vulnerability imply that we need to change passwords for *all* systems?
which browsers is it that you think use OpenSSL?
Mar
31
comment Is it a real security benefit if a host uses static IP Addresses for authentication?
interesting paper but unless I'm missing something to get a single spoofed connection he's sending out 300,000 packets per second for 8 minutes and that give 1 packet to ACK and do a blind request. Not the most practical for application level attacks like HTTP unless the attacker knows how to attack the system with a single request. all the same a good illustration of my last point which is "don't rely on it on its own"
Mar
29
comment How do I prove for my client that unused ports are closed and unused services are disabled?
Indeed good point, additionally there are downloadable guides from places like CIS (benchmarks.cisecurity.org/downloads) that often have audit procedures in them
Mar
21
comment What are the security features of JRE 8?
This securitycurmudgeon.com/2014/03/20/… contains a pretty good looking summary of Java7/8 security features..
Mar
7
comment DOM XSS attack failing in Firefox
+1 for the interesting link
Mar
5
comment Credit card data
it's on the support portal under downloads-->Compliance and Audit Files-->Sensitive Content Audit Policies
Mar
5
comment Bitlocker on a laptop without carrying around recovery key
not an answer to your problem, but I'll say that I moved away from Bitlocker for this very reason. Starting your laptop in a customers datacentre which took 20 mins to get into, only to have it do the bitlocker blue screen of death was not fun! You could look at Self-encrypting SSDs as an option
Feb
28
comment Locate rogue wireless access point using Kismet data
I've not got experience of setting up a static kismet rig for detection although I'd imagine that you could do it with triangulation of the signal strength. Definitely there's commercial products (e.g. Ciscos wireless kit) which use that method to locate rogues with static APs
Feb
26
comment programs or methods to review Internet browser applications for security
not for me it doesn't... goes here releases.mozilla.org/pub/mozilla.org/firefox/releases and seems to work ok..
Feb
24
comment How to decrypt passwords gained by wireshark?
surely if all you're looking to do is see who is using your VPN, the plaintextusername should do the job, you wouldn't need to decrypt the password.
Feb
23
comment Is using SHA-512 for storing passwords tolerable?
@senfo I'd agree but then when you run into an unsupported legacy system written by a third-party who have gone out of business, it's amazing how much simple fixes can cost...
Feb
22
comment Is using SHA-512 for storing passwords tolerable?
Sorry, but I'll have to disagree with you there. All businesses are commercial entities who are there to make money, not be "perfectly secure" (as if such a thing exists) and in those businesses security is a trade-off. If as a security person you tell the business to spend whatever is necessary to implement a control, you won't get much joy I'm afraid. As to Sony and the rest, do you have some citations for their risk analysis before their breaches?
Feb
21
comment What is the difference between ordinary XSS and Dom XSS vulnerabilities?
@N1CK that's a kind of long topic and not really a Sec.SE one. in essence it's usually a means of manipulating HTML documents programatically some good info here developer.mozilla.org/en/docs/DOM
Feb
17
comment How to best use JavaScript to encrypt client side so the server never sees it?
Yes but where does the client get the JavaScript to do the encryption from? the server (in a standard web app). So the server can replace it with malicious JavaScript... so what's the point of the encryption? So the secure information the server sends is the program code used to do the encryption...
Feb
17
comment Bridged routers security
Well if you have a border router with 3 interfaces, assign one to "good LAN" one to "bad LAN" and one to "Internet" this would improve things as you don't have traffic from one going over the other. Then you just have to worry about stopping "bad LAN" computers from administering the router and potentially things like DNS poisoning attacks...
Feb
17
comment Bridged routers security
yep if traffic transits a potentially hostile network and it's not using protocols which resist such attacks (e.g. properly configured SSL) there is a risk. With the other way round the risks are a bit different (you need to be careful that "bad LAN" machines can't send traffic to "good LAN" machines on their way to the Internet...
Feb
17
comment Bridged routers security
hmm well depends on the router... I'm assuming here you have control of the network, so you can set creds for the login. Ideally you'd limit the IP addresses that can manage the system, but failing that you could set strong usernames/passwords and just don't tell the people on "bad LAN" :) In terms of them doing anything, well not really, if all your traffic is SSL encrypted and you check certificates, they shouldn't be able to easily intercept your traffic...
Feb
14
comment Legacy system PCI Compliance
I'm afraid the only person who can effectively answer your question is your QSA. As I understand it (and I hasten to add I'm not a QSA), it's cardholder environments that are certified, so if the old system is in the same environment as the new one it would be tricky to see how that could get certified. However as I say best bet is to ask the QSA...