1,603 reputation
4711
bio website
location Redmond, WA
age 23
visits member for 3 years, 5 months
seen Feb 7 at 7:03

I'm a Microsoft Software Development Engineer on the Trustworthy Computing Team. I've worked at several security related places previously, including Malware Bytes and PreEmptive Solutions.

On StackOverflow I mostly answer related questions, though I occasionally forray into and a couple of others.

I am the author of pevFind, a component of the ComboFix malware removal tool, and volunteer at BleepingComputer.com as a malware response instructor. My Twitter account is @MalwareMinigun.


Nov
21
awarded  Yearling
Oct
25
comment At what point does adding more iterations to PBKDF2 provide no extra security?
I think sun limited Crypto is sufficient :D +1
Sep
25
comment Flash ignores Content-Type header, allowing XSS?
@D.W.: "Giving flash a path" to execute is the same thing as eval -- it is something the web page asked the browser to go fetch and said "this is a SWF, please interpret it that way for me".
Sep
25
answered Flash ignores Content-Type header, allowing XSS?
Apr
23
answered How can JavaScript be tampered with while viewing a web page?
Feb
26
comment When cellphone providers give “unlimited social networking”, how do they identify the traffic?
What vendor is advertising this?
Feb
11
comment Why doesn't Microsoft implement salt on users passwords in Windows?
I suspect they are not eager to change it because everyone in important is hopefully using Kerberos by now...
Jan
29
answered Can malware hide their network activity from Resource Monitor (perfmon)?
Dec
3
comment Using PDF instead of doc(x) or html: safer?
I would argue the reverse in the last paragraph. PDF exploits are extremely common because many browsers will open a document as a PDF without request from the user; whereas opening a word document typically requires opening the document in a separate application and users are slightly more wary of such things.
Dec
3
comment XKCD #936: Short complex password, or long dictionary passphrase?
@Eric: I believe the comic and answers below answer that pretty well. Using a dictionary helps, sure. But even if you have a dictionary of 2^12 words (which is a pretty small dictionary), four words still gives you 50 bits of entropy. (which is exactly what the comic demonstrates with the little boxes) At 1000 guesses / second that's hundreds of years. (As the comic says, cracking a stolen hash is faster; but most any password can be cracked fast with that method)
Nov
21
awarded  Yearling
Jul
24
comment What are the vulnerabilities of using NFC on my Samsung SGS3?
Are you looking for known vulnerabilities or possible attack surface?
Jun
19
comment XKCD #936: Short complex password, or long dictionary passphrase?
@ugurcode: Note that it says *insecure web service*. Yes, well designed systems do limit the number of password attempts, but not all do. Also, if the attacker has a decent sized botnet IP based blocking isn't going to help you anyway. You'd additionally have to have username-per-time based denial, at the very least.
Apr
18
comment CDNs used by Windows Update
Keep in mind that Microsoft allows anyone willing to pay to use it's CDN services. windowsazure.com/en-us/home/features/cdn
Apr
18
comment Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once?
It should be noted that the CMRR utility fails for modern drives too simply because it's a DOS tool; and DOS does not understand SATA or other kinds of recent HDD controller systems.
Apr
16
comment If we cast a value is it still necessary to escape it with mysqli_real_escape_string()?
@Sheriff: Performance issues? And you think the escaped version is going to do any better?
Mar
17
comment How will security need to be changed if P=NP?
SAT is in class NP == which requires that verifying a correct solution can be done in polynomial time. For most symmetric ciphers, unless the attacker knows some part of the cleartext, there's no polynomial time way to determine whether you found the correct key. Therefore that's not in any way related to SAT. Of course if the attacker can control some of the cleartext then the verification step is made easy, and things are reduced to NP complexities.
Mar
17
comment How will security need to be changed if P=NP?
@D.W.: That's fair; it would be devastating. But it wouldn't necessarily mean all current symmetric algorithms would be garbage; just much less useful.
Mar
17
comment How will security need to be changed if P=NP?
@D.W.: How can you express symmetric key encryption in terms of SAT? You can't verify, given a decryption, whether it's the right decryption, easily (unless the attacker can do a "chosen plaintext" attack). That would be required to place it in class NP.
Mar
16
comment How will security need to be changed if P=NP?
Ah, I see then. Many symmetric algorithms are not NP hard (they are "worse" than that) according to that standard. Unless the attacker can do a known cleartext attack, that is.