Reputation
Next tag badge:
593/400 score
74/80 answers
Badges
17 146 240
Newest
 Nice Answer
Impact
~2.4m people reached

1h
comment Security Issue on windows 8
The sensible answer is to re-install your OS.
1h
comment Security Issue on windows 8
Looks like malware.
1d
comment What is HiASLR?
@Voo Come to think of it, I don't understand that one either. I've emailed Matt Miller to see if I can get some clarification.
1d
comment What is HiASLR?
@Voo I believe what "Non-ASLR DLL images (opt-in)" refers to is DLLs without the NX compatible flag in their header (i.e. no compile-time support) but with the opt-in mitigations enabled for the process, via one of the options listed in slide 39.
1d
answered EMET disable DEP on IE for specific site
1d
comment What are the privacy and security implications of Windows Telemetry
@Begueradj Read the article I linked. The Enterprise version offers the "turn off" option in the GUI, but the registry fix works regardless of your OS edition.
1d
comment NX + ASLR bypass - troubles with return address of .bss
Good point; strcpy won't copy a null, hence your problem in the first place. You could use a memcpy gadget instead, or look for a gadget that'll do something like pop eax; mov [eax+??], 0; ret (where eax could be any general purpose register, and the offset is any sensible value, or just zero). This would let you do an arbitrary memory write of null bytes.
1d
comment NX + ASLR bypass - troubles with return address of .bss
Try adding a 3rd strcpy gadget using a rop gadget that points to a null byte, so that bss+3 is set to \0, thus terminating the string before any junk.
1d
comment FIPS 140-2 Compliance vs Validation & Products vs. Modules vs. Ciphers
I believe that a cryptographic module is defined as an implementation, whereas cryptographic algorithms and ciphers are (as the name indicates) just algorithms and ciphers like Diffie-Hellman, AES, RSA, etc. From what I can tell, NIST requires organisations subject to FIPS 140-2 to use FIPS 140-2 compliant cryptographic modules, which in turn can only utilise FIPS 140-2 complaint algorithms and ciphers. I can't find any guidance on whether explicit validation has to be performed on modules for correct compliance, though.
1d
comment iOS application pentest without jailbreak
You could use an iOS emulator, though I'm not sure exactly how representative they are of the real thing.
2d
comment Problems executing shellcode via nop-sled
@bjax15 I don't know what you're trying to exploit, or why you need to push those values to the stack. You could indeed set esp to an address you know to contain allocated read+write protected pages if you really do need use of a stack. Or of course you could execute an add esp, +0x???? to move the stack pointer relative to the current value, for reliability.
2d
comment Problems executing shellcode via nop-sled
@raz That's useful too, but an online solution gives you access to both assembly and disassembly on any platform, including phones, from pretty much anywhere. Also, ODA supports almost every modern-ish processor and instruction set ever invented, which is kinda awesome.
2d
comment Problems executing shellcode via nop-sled
@Begueradj This is specific enough to security that it is on-topic here.
2d
comment Problems executing shellcode via nop-sled
On this topic, you can use Defuse x86 online assembler to assemble instructions into bytes online, or do the reverse with ODA Online Disassembler. Both really useful tools for quickly checking how instructions/bytes assemble or disassemble.
2d
comment Problems executing shellcode via nop-sled
@Begueradj How is this off-topic? It's about fixing broken shellcode, which is certainly on-topic here. It's not strictly a single-person fix, because others may also presume that they can use push in stack-based shellcode without it breaking.
2d
answered Problems executing shellcode via nop-sled
2d
comment Definition of security incident
As an example: the IR steps for someone accidentally leaking their AD password over Skype are completely different to the IR steps for a malware outbreak or a physical breach, and they are also different to a breach of PCI infrastructure or a leak of customer data. Certain things need to be reported to regulatory bodies, certain breaches require customers to be notified, certain events require C-level staff to be appraised. A major goal of an IR policy is to define the meaning of "security incident" in the context of the company's different infrastructure segments.
2d
comment Definition of security incident
Schroeder is correct. To be clear, a good IR policy doesn't just state what has to be done, but also defines the circumstances in which actions should be applied, who needs to be notified, the timeframes of each step, and also explains why each of these are important. This gives a context for the person applying the IR policy, so that improvisations can be made should something unusual arise.
2d
comment Definition of security incident
Absolutely anything event that may have negatively impacted the security of an organisation can be considered a "security incident".
2d
comment What security problems are exposed by running untrusted macros in excel?
@NeilSmithline Agreed. It should be made clear that obscurity measures work best against threat actors that are likely to be performing generic attacks against a wide number of people. If your expected threat actor is likely to be tailoring things for you or your organisation specifically, they won't be anywhere near as effective.