55,290 reputation
17132226
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 7 months
seen yesterday

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Sep
20
comment Code signing with MD5 on Windows 8
Microsoft has cut MD5 support for code signing.
Sep
20
comment Steganography to hide text within text
+1 for spammimic. It rocks :)
Sep
20
answered What are the career paths in the (illegal) computer security field?
Sep
20
comment What are the career paths in the (illegal) computer security field?
Very interesting question! I often wonder the same thing...
Sep
19
awarded  Nice Answer
Sep
19
awarded  Enlightened
Sep
19
awarded  Nice Answer
Sep
19
revised Exploiting tomcat's vulnerability CVE-2009-2693 Arbitrary file deletion and/or alteration on deploy
deleted 2 characters in body; edited title
Sep
19
comment Zero day vulnerability appropriate corrective action
Agree with Ramhound here. After digging into some of the other articles by the same author, as well as his Twitter feed, it's pretty obvious he's got a bit of a grudge against Microsoft.
Sep
19
comment Zero day vulnerability appropriate corrective action
+1 on this. Microsoft have a rigorous testing cycle, but some bugs are nasty enough to warrant a patch being released with only minimal testing completed. The patch EULA seems to reflect this, too - they're claiming zero liability for damages.
Sep
19
revised From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work?
added 76 characters in body
Sep
19
answered From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work?
Sep
19
comment From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work?
It's not a buffer overflow, it's a use-after-free.
Sep
19
comment Meaningless http request
@GdD Interestingly, it's not random. You can find a few instances on Google. The last part looks like keyboard hammering (notice the proximity of the letters on a qwerty keyboard) so I guess it's a hard-coded value designed to always generate a 404.
Sep
19
answered Meaningless http request
Sep
19
comment How to prepare for a career in Pen-Testing
My advice: Stop listening to Security Now!, now. Steve Gibson is on attrition.org's list of charlatans, primarily because a lot of what he does is FUD to get you to buy his products and services. There are plenty of other security podcasts out there: LiquidMatrix, Netsec, Risky Business, Paul Dot Com, etc. (Disclaimer: Your mileage may vary!)
Sep
19
comment Memory Dumping - Cause for concern in Virtualization?
@TerryChia Yeah, though it depends what services are visible on the host. Often the host will simply be a barebones system, or even a VM host OS (e.g. VMware ESX), which has little or no services.
Sep
18
answered How could one avoid virus infection via software updates
Sep
18
comment How do I prevent data from leaving my network?
Unplug the network cable.
Sep
18
comment How can I prevent forwarding a manipulated email?
@HendrikBrummermann I'm aware of that, but it's not a human security question, it's a HR question. If he asked "how do I convince people that changing stuff in an email is bad for security?", then sure. But instead, it boils down to "how should I stop my employees from being manipulative asshats?", which is off topic.