Eric G

3,016 reputation

425

bio	website	ericgoldman.name
	location	Chicago, IL
	age
visits	member for	1 year, 8 months
	seen	May 20 at 21:16
stats	profile views	83

Currently, IT Security Consultant for multinational, focusing on application risk. Previously IT Auditor for a large accounting firm, where I performed IT Audits and Pen Testing for financial services, healthcare, and other industries.

	3,016 reputation	bio	website	ericgoldman.name	visits	member for	1 year, 8 months
425 badges		location	Chicago, IL		seen	May 20 at 21:16

summary answers questions tags badges favorites bounties reputation activity

421 Actions

suggestions reviews revisions comments badges posts accepts all

Apr 22	comment	Is there any SQL injection for this PHP login example? If you are new to PHP, I would not recommend writing your own logon form. I would try to plug in some framework or at least find an example where the author stresses security in the title. You should of course now how to look for faults, but there are many complexities and bad things that can happen even beyond SQL injection from a logon form.
Apr 22	revised	Is there any SQL injection for this PHP login example? Fixed title, corrected grammar, added relevant tags; eg removed unneccesary greetz and fixed indentation on first code sample
Apr 21	reviewed	Reject suggested edit on Are latency based Proof-of-Work systems capable of preventing DDoS attacks on popular hidden tor services (.onion websites)?
Apr 21	revised	Security difference in wardriving open network versus monitoring traffic on a network to which I am authenticated the title really isn't about wardriving, but asking about if its okay to capture traffic on a network for which one is authenticated.
Apr 19	comment	Using / finding covert channels in inter-process communication everything is on the same host, e.g., no network only writing to named pipes?
Apr 18	answered	How to hack a switch connected network with static ARP?
Apr 18	comment	Using / finding covert channels in inter-process communication Can you clarify a little? You get to logon to the server, and observe communications? Or you only get to connect to the server with a version of the client? If you have access to the server, you have a regular user account that can't capture traffic or open privileged files?
Apr 18	reviewed	Approve suggested edit on How to increase VoIP call security?
Apr 18	answered	Security concerns with malicious NFC tags?
Apr 17	comment	Security concerns with malicious NFC tags? I reviewed the other questions when originally authoring, but I wanted to talk about malicious things which can specifically be done with a limitation of tags instead of more complex and interactive systems like payments, etc.
Apr 17	revised	Security concerns with malicious NFC tags? added wikipedia reference
Apr 17	comment	Security concerns with malicious NFC tags? I understand how the Tasker scenario works, but that doesn't mean its not possible to write an application that is always listening and reading tags and would automatically launch a URL. The scenario in my last comment was finding a tag with a specific action which is known, then cloning, and replacing another tag elsewhere with that cloned value. As I noted, it would be limited attack to that person, messing with trust in his/her own tags.
Apr 17	comment	Security concerns with malicious NFC tags? In terms of MiTM attacks on the NFC or easdropping, is there any type of verification or integrity check when reading a NFC or is it really your reader is listening for some id code in a broadcast/anycast type fashion?
Apr 17	comment	Security concerns with malicious NFC tags? Are there no public use of such tags? I imagine over time people would see the convenience over even QR code. Imagine a museum with a tag on the placard next to a painting. With any type of input you can require a check before processing. I imagine a limited attack would be changing the codes to that of a different code (turn on airplane mode vs turn on) if you cloned it to do a limited DoS.
Apr 17	comment	Security concerns with malicious NFC tags? A simple attack on QR code is to replace an expected code with another. If there is a flyer with a QR code and a note "click here to go to the page", if someone places a sticker over the code you may not be able to tell the page has been substituted.
Apr 17	asked	Security concerns with malicious NFC tags?
Apr 17	answered	How do random attackers discover websites to target?
Apr 17	comment	Automatic router admin password change Its sounds like he is asking why/how is getting attacked through some type of drive by, with cleanup this could be salvageable question.
Apr 16	awarded	Custodian
Apr 15	revised	how can an attacker use a fake temp file to compromise a program? added cwe