1,608 reputation
4711
bio website
location Redmond, WA
age 24
visits member for 3 years, 11 months
seen Oct 25 at 1:22

I'm a Microsoft Software Development Engineer on the Trustworthy Computing Team. I've worked at several security related places previously, including Malware Bytes and PreEmptive Solutions.

On StackOverflow I mostly answer related questions, though I occasionally forray into and a couple of others.

I am the author of pevFind, a component of the ComboFix malware removal tool, and volunteer at BleepingComputer.com as a malware response instructor. My Twitter account is @MalwareMinigun.


Oct
8
comment How secure is my DPAPI Master Key if I enable biometric login?
Answer deleted since Thomas' is better, but point remains: DPAPI doesn't generally prevent someone who steals the machine from stealing your data. See CryptProtectMemory for more details.
Oct
8
comment How secure is my DPAPI Master Key if I enable biometric login?
Ah, I see. +1 then :).
Oct
8
comment How secure is my DPAPI Master Key if I enable biometric login?
If the data is encrypted at rest (e.g. BitLocker or TrueCrypt) then physical access may not be sufficient without a key. But that's not the question the user asked...
Aug
1
comment Can the USB standard be altered to prevent the “firmware attack”?
Firmware bugs have been around for years. The reason you don't see them deployed much in practice is that the money isn't there -- exploits only work against a specific firmware / board / system. It isn't like a browser or Flash or similar you can expect to be on a large percentage of the world's computers.
Aug
1
comment Can the USB standard be altered to prevent the “firmware attack”?
+1. By the Wired standard, nothing could ever connect to anything, because everything may have come in contact with something untrusted somewhere in the past. Firmware is everywhere, and quite a lot of it is buggy.
Jun
17
comment Identical lanman hashes on AD accounts?
It makes me very sad that we are still dealing with the specter of LANMAN hashes given that the last OS that required them (Windows 95) went out of support on December 31, 2001. (Even Win98 supports NTLMv2 with patches)
Nov
21
awarded  Yearling
Oct
25
comment At what point does adding more iterations to PBKDF2 provide no extra security?
I think sun limited Crypto is sufficient :D +1
Sep
25
comment Flash ignores Content-Type header, allowing XSS?
@D.W.: "Giving flash a path" to execute is the same thing as eval -- it is something the web page asked the browser to go fetch and said "this is a SWF, please interpret it that way for me".
Sep
25
answered Flash ignores Content-Type header, allowing XSS?
Apr
23
answered How can JavaScript be tampered with while viewing a web page?
Feb
26
comment When cellphone providers give “unlimited social networking”, how do they identify the traffic?
What vendor is advertising this?
Feb
11
comment Why doesn't Microsoft implement salt on users passwords in Windows?
I suspect they are not eager to change it because everyone in important is hopefully using Kerberos by now...
Jan
29
answered Can malware hide their network activity from Resource Monitor (perfmon)?
Dec
3
comment Using PDF instead of doc(x) or html: safer?
I would argue the reverse in the last paragraph. PDF exploits are extremely common because many browsers will open a document as a PDF without request from the user; whereas opening a word document typically requires opening the document in a separate application and users are slightly more wary of such things.
Dec
3
comment XKCD #936: Short complex password, or long dictionary passphrase?
@Eric: I believe the comic and answers below answer that pretty well. Using a dictionary helps, sure. But even if you have a dictionary of 2^12 words (which is a pretty small dictionary), four words still gives you 50 bits of entropy. (which is exactly what the comic demonstrates with the little boxes) At 1000 guesses / second that's hundreds of years. (As the comic says, cracking a stolen hash is faster; but most any password can be cracked fast with that method)
Nov
21
awarded  Yearling
Jul
24
comment What are the vulnerabilities of using NFC on my Samsung SGS3?
Are you looking for known vulnerabilities or possible attack surface?
Jun
19
comment XKCD #936: Short complex password, or long dictionary passphrase?
@ugurcode: Note that it says *insecure web service*. Yes, well designed systems do limit the number of password attempts, but not all do. Also, if the attacker has a decent sized botnet IP based blocking isn't going to help you anyway. You'd additionally have to have username-per-time based denial, at the very least.
Apr
18
comment CDNs used by Windows Update
Keep in mind that Microsoft allows anyone willing to pay to use it's CDN services. windowsazure.com/en-us/home/features/cdn