52,958 reputation
16125218
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 5 months
seen 17 mins ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


1h
comment How to convince my management of a physical security risk
@RoryAlsop FC's talks are never recorded, unfortunately. Makes sense, as he wants to minimise the number of people who know what he looks like.
5h
answered How to convince my management of a physical security risk
2d
comment Why Adobe is recommending McAfee security scan during flash player installation?
@Pacerier It's a reference to a scene from Spaceballs.
Mar
25
awarded  Enlightened
Mar
25
awarded  Nice Answer
Mar
23
awarded  Good Answer
Mar
23
comment Can a Trojan hide itself, so its activity doesn't appear in task manager process?
@DanNeely Process Monitor, as far as I understand, doesn't bother with the toolhelp functions and goes straight to the ntdll stuff, so hooking Process32First/Next won't beat it. Hooking NtQuerySystemInformation should still hide it from ProcExp, as should anything lower down. You'd have to do investigation with a kernel debugger (e.g. WinDbg) to identify hooks at that level. Hidden EPROCESS entries require some more in-depth analysis. Stuff like SSDT / IDT hooks will require forensic memory dumps.
Mar
23
comment Safely encrypting data received through HTTPS
@StijnFrishert Then rethink your security model. You're trying to invent a DRM system, which is a fatally flawed premise. The user's computer is theirs to control. If your security model involves treating it as trusted (it isn't) then your security model is wrong. More specifically: if the data is ever read or acted upon on the user's computer, then that data (and the code) is theirs to modify, thereby entirely bypassing your security controls.
Mar
23
awarded  Nice Answer
Mar
23
answered Tell if someone accessed my filesystem
Mar
23
revised Can a Trojan hide itself, so its activity doesn't appear in task manager process?
added 210 characters in body
Mar
23
comment Safely encrypting data received through HTTPS
Ok. Part 3 confuses me a little - who needs to access the data? What's your threat model?
Mar
23
comment Safely encrypting data received through HTTPS
What OS are you doing this on?
Mar
23
answered Crypto Ransomware - How decryption is done when user accept to cooperate?
Mar
23
awarded  Disciplined
Mar
23
comment Utimaco CryptoServer Simulator
You're much more likely to get an answer by emailing them. They list hsm@utimaco.com for support.
Mar
23
comment OpenSSL: Allow CBC ciphers for TLS but prevent for SSL3
Can you post what you're passing to that function? From my understanding, there are two ways to do it: (1) use the - prefix to disable the block ciphers (AES, DES3, etc.) then follow it by +TLSv1+TLSv1.2 and then more - prefixed strings to disable any ciphers globally (e.g. export), or (2) manually maintain a list of full cipher strings with flags about when they should or shouldn't be enabled, and build a full list from that depending on options.
Mar
23
comment OpenSSL: Allow CBC ciphers for TLS but prevent for SSL3
How exactly are you disabling CBC-mode ciphers?
Mar
23
comment Can a Trojan hide itself, so its activity doesn't appear in task manager process?
@CodeClown All of these hooks require the attacking process to be running as an administrator. The latter ones require driver load privileges. The solution is not to run malicious code on your system - follow safe practices, enable UAC, use a VM / sandboxing for testing untrusted stuff, run an AV (MSSE is fine), and install and configure EMET to get some additional protection against exploits.
Mar
23
answered XSS when some keywords are prevented on the server side