7,175 reputation
11835
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 8 months
seen 19 hours ago

19h
comment How secure is binding to localhost in order to prevent remote connections?
Project Zero - Finding and exploiting ntpd vulnerabilities wrote "Any IP packet arriving on an external interface and with the source IP 127.0.0.1 will be dropped immediately. But if we use IPv6 instead we can actually spoof ::1 and send control mode packets to the daemon (some Linux distributions have firewall rules in place that protect against this, e.g. Red Hat). Thus, if we are on the same local network, we can send spoofed packets to the link-local address of the target"
1d
comment How secure is binding to localhost in order to prevent remote connections?
Apparently computers in the local network can spoof the IPv6 equivalent ::1 on some operating systems.
1d
comment Custom socket server on the internet running as root
You could mmap only the required part of /dev/mem while running as root and then drop root privileges.
1d
comment Does reboot clear RAM?
@ArekBulski tails.boum.org/contribute/design/memory_erasure
2d
comment How to pick an encryption algorithm (cipher) and mode for PHP's mcrypt, for encrypting passwords?
See my answer to Strongest cryptographic algorithm available in PHP 5.3
Apr
22
comment How can I ensure my dll has not been modified?
Sounds like the usual impossible to solve DRM problem.
Apr
22
reviewed Approve What are the main differences between a Metasploit vulnerability/exploit attack and a “R.A.T.” attack?
Apr
21
revised Is it a ISO27001 requirement to record details of all instant messages?
deleted 22 characters in body
Apr
21
comment Copyright Issue?
1) How about simply sending them an email asking them to cease their use of these icons? 2) What do you mean by "copyrighting them"? You automatically own the copyright for any copyrightable works you create. All you can do is registering the copyright to make legal disputes easier.
Apr
21
comment If I were to perform a MD5 hash every microsecond from 1-1-1970 how many hash colisions would I have
1Mhash/s is pretty slow for todays standards. A single good GPU is more than a thousand times faster than that (9 Ghash/s).
Apr
21
comment Decoding SHA-512 value
Rainbow tables use hash chaining to reduce the rate of growth below linear.
Apr
20
comment Decoding SHA-512 value
Where do they state that they're using a rainbow table? The description it sounds like they don't: "in our DB we store millions (soon billions) of words and different strings aside to their hash". Also the number of 250M records is pretty low for a rainbow table. I'd assume that they use a simple lookup table, not a rainbow table.
Apr
19
comment Sites being redirected to adult site in all devices
Perhaps your router has been infected. Perhaps it has been configured to use a malicious DNS server.
Apr
19
comment What do you need to make your own R.A.T.?
Just buy a couple of rodents and breed them until they develop the features you want. Genetic manipulation might speed up the process a bit.
Apr
14
revised How practicable is application whitelisting
edited tags
Apr
14
comment RSA private/public keys
How did you end up with a partial private key? And what exactly do you mean by that? Part of the private exponent d? Or part of a "full" private key with d, p, q, dp etc.? The the latter case you might have received the full` value of p or q which would make factoring trivial.
Apr
14
comment RSA private/public keys
I believe that you can use lattice reduction method to attack RSA if you know part of the private key far more efficiently than brute-force. But I'm no expert in that kind of maths.
Apr
14
comment Why does the user pick the password?
One important question is if the password protects the user, or if the password protects the user's access to somebody else's formation (e.g. a company account).
Apr
13
comment How can I prevent a man-in-the-middle (MITM) attack on my Android app API?
Are you really interested in security or do you want some kind of DRM?
Apr
3
comment TrueCrypt vs BitLocker
If you want to use TrueCrypt you need to disable certain modern technologies it's not compatible with. For example MBR vs. GPT or EFI vs. BIOS.