52,998 reputation
16125218
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 5 months
seen 8 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


8h
comment Signal strength constantly changing on Linksys WRT54G?
The message you're seeing is being emitted by this piece of code, which causes a log message whenever the representative AP (i.e. the AP that you're currently talking to for a particular SSID) changes. Since your signal is poor or at least intermittent, you're losing sight of the AP and later re-acquiring the signal, resulting in a "new" representative AP being logged. The ieee80211_securitytype message is referring to 802.11 security (WEP/WPA).
8h
revised Signal strength constantly changing on Linksys WRT54G?
Formatting
8h
comment can you know the computer that an email came from?
Are you talking about the sender's IP? Because that is often recorded in the headers, though obviously the sender may use an anonymous mail agent or other anonymising methods (e.g. a proxy, VPN, Tor, etc.) to send the mail.
14h
comment Security tips for online Debit/Credit Card Transactions?
The first part of the question is on-topic, though, so it doesn't need to be closed.
17h
comment How to convince my management of a physical security risk?
@RoryAlsop FC's talks are never recorded, unfortunately. Makes sense, as he wants to minimise the number of people who know what he looks like.
21h
answered How to convince my management of a physical security risk?
Mar
29
comment Why Adobe is recommending McAfee security scan during flash player installation?
@Pacerier It's a reference to a scene from Spaceballs.
Mar
25
awarded  Enlightened
Mar
25
awarded  Nice Answer
Mar
23
awarded  Good Answer
Mar
23
comment Can a Trojan hide itself, so its activity doesn't appear in task manager process?
@DanNeely Process Monitor, as far as I understand, doesn't bother with the toolhelp functions and goes straight to the ntdll stuff, so hooking Process32First/Next won't beat it. Hooking NtQuerySystemInformation should still hide it from ProcExp, as should anything lower down. You'd have to do investigation with a kernel debugger (e.g. WinDbg) to identify hooks at that level. Hidden EPROCESS entries require some more in-depth analysis. Stuff like SSDT / IDT hooks will require forensic memory dumps.
Mar
23
comment Safely encrypting data received through HTTPS
@StijnFrishert Then rethink your security model. You're trying to invent a DRM system, which is a fatally flawed premise. The user's computer is theirs to control. If your security model involves treating it as trusted (it isn't) then your security model is wrong. More specifically: if the data is ever read or acted upon on the user's computer, then that data (and the code) is theirs to modify, thereby entirely bypassing your security controls.
Mar
23
awarded  Nice Answer
Mar
23
answered Tell if someone accessed my filesystem
Mar
23
revised Can a Trojan hide itself, so its activity doesn't appear in task manager process?
added 210 characters in body
Mar
23
comment Safely encrypting data received through HTTPS
Ok. Part 3 confuses me a little - who needs to access the data? What's your threat model?
Mar
23
comment Safely encrypting data received through HTTPS
What OS are you doing this on?
Mar
23
answered Crypto Ransomware - How decryption is done when user accept to cooperate?
Mar
23
awarded  Disciplined
Mar
23
comment OpenSSL: Allow CBC ciphers for TLS but prevent for SSL3
Can you post what you're passing to that function? From my understanding, there are two ways to do it: (1) use the - prefix to disable the block ciphers (AES, DES3, etc.) then follow it by +TLSv1+TLSv1.2 and then more - prefixed strings to disable any ciphers globally (e.g. export), or (2) manually maintain a list of full cipher strings with flags about when they should or shouldn't be enabled, and build a full list from that depending on options.