Reputation
59,020
Next tag badge:
593/400 score
74/80 answers
Badges
17 146 240
Newest
 Nice Answer
Impact
~2.3m people reached

15m
comment Problems executing shellcode via nop-sled
@raz That's useful too, but an online solution gives you access to both assembly and disassembly on any platform, including phones, from pretty much anywhere. Also, ODA supports almost every modern-ish processor and instruction set ever invented, which is kinda awesome.
17m
comment Problems executing shellcode via nop-sled
@Begueradj This is specific enough to security that it is on-topic here.
19m
comment Problems executing shellcode via nop-sled
On this topic, you can use Defuse x86 online assembler to assemble instructions into bytes online, or do the reverse with ODA Online Disassembler. Both really useful tools for quickly checking how instructions/bytes assemble or disassemble.
25m
comment Problems executing shellcode via nop-sled
@Begueradj How is this off-topic? It's about fixing broken shellcode, which is certainly on-topic here. It's not strictly a single-person fix, because others may also presume that they can use push in stack-based shellcode without it breaking.
26m
answered Problems executing shellcode via nop-sled
20h
comment Definition of security incident
As an example: the IR steps for someone accidentally leaking their AD password over Skype are completely different to the IR steps for a malware outbreak or a physical breach, and they are also different to a breach of PCI infrastructure or a leak of customer data. Certain things need to be reported to regulatory bodies, certain breaches require customers to be notified, certain events require C-level staff to be appraised. A major goal of an IR policy is to define the meaning of "security incident" in the context of the company's different infrastructure segments.
20h
comment Definition of security incident
Schroeder is correct. To be clear, a good IR policy doesn't just state what has to be done, but also defines the circumstances in which actions should be applied, who needs to be notified, the timeframes of each step, and also explains why each of these are important. This gives a context for the person applying the IR policy, so that improvisations can be made should something unusual arise.
22h
comment Definition of security incident
Absolutely anything event that may have negatively impacted the security of an organisation can be considered a "security incident".
23h
comment What security problems are exposed by running untrusted macros in excel?
@NeilSmithline Agreed. It should be made clear that obscurity measures work best against threat actors that are likely to be performing generic attacks against a wide number of people. If your expected threat actor is likely to be tailoring things for you or your organisation specifically, they won't be anywhere near as effective.
23h
answered What security problems are exposed by running untrusted macros in excel?
1d
comment What are the privacy and security implications of Windows Telemetry
Also, the answer to this depends on your settings. The "Basic" option sends back your hardware spec, list of installed programs, and some of your configuration settings in Windows. I don't know the details of what gets sent with other options.
1d
comment What are the privacy and security implications of Windows Telemetry
Switching OS seems a bit drastic. Just disable telemetry entirely.
Aug
24
answered What is a typical defense mechanism/setup against flooding back-end sql calls?
Aug
24
revised BitLocker : Update Volume Master Key and meaning of “keyed” vs “re-keyed”
added more relevant text
Aug
24
comment BitLocker : Update Volume Master Key and meaning of “keyed” vs “re-keyed”
My bad - I somehow misread that entirely. I'll edit that in.
Aug
24
answered BitLocker : Update Volume Master Key and meaning of “keyed” vs “re-keyed”
Aug
21
comment What is the argument for the fairly prevalent “No more than n repeating characters” password rule?
I think the line of thinking is that "Aaaaaaaa9" is a bad password, and preventing repeated characters should stop them from being used. I agree that it's a bad way to go about it though.
Aug
21
awarded  Nice Answer
Aug
21
awarded  Good Answer
Aug
20
awarded  Nice Answer