56,835 reputation
17138233
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 9 months
seen 16 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Sep
24
comment What are the disadvantages of single sign-on authentication?
Essentially the problem boils down to the fact that you're handing your security mechanisms to an opaque 3rd party. This is, simultaneously, single sign-on's biggest advantage and disadvantage. You sacrifice certainty about security for a range of other security benefits, and a few other benefits (ease of use, implementation overhead reduction, etc.)
Sep
24
revised What are the disadvantages of single sign-on authentication?
formatting, grammar
Sep
23
comment How will security need to be changed if we can crack password hashes in quasi-polynomial time?
<tinfoil> But the NSA might already be doing this! </tinfoil>
Sep
23
comment Stack Overflows - Defeating Canaries, ASLR, DEP, NX
Yes. The NX bit just provides hardware enforcement of the executable memory page protection flag. With NX disabled, it's trivial to execute pages that don't have the executable bit set, because the processor won't recognise the difference. With NX enabled, you cannot execute non-executable pages. However, VirtualProtect alters the protection flags on the page, so it actually is marked as executable, which the CPU will then allow.
Sep
23
comment How to defeat ASLR in linux kernel?
You'd need a privilege escalation to root, or file write privilege check bypass.
Sep
22
reviewed Approve How to create ssh tunnel using netcat?
Sep
22
comment How to achieve interactive shell attack?
@tylerl That's the source of the term, yes. Doesn't mean it still means that, though :)
Sep
22
awarded  Nice Answer
Sep
22
comment Nmap port scan and FTP bounce
Isn't the flag for disabling ping -Pn, rather than -P0?
Sep
22
comment What security settings are likely used in Obama's Blackberry?
@AviD Secret Service likely borrowed someone from the NSA as a consultant.
Sep
22
comment Resources on security risks of NFC
Related: How secure is NFC on mobile devices? and What are the vulnerabilities of using NFC on my SGS3?
Sep
22
revised How to achieve interactive shell attack?
shellcode != shell :)
Sep
21
awarded  Custodian
Sep
21
comment How can I recognize and find file(s) dropped by malware?
Possibly. But the second part of the scenario is the important point - you have to run a process on the box, which the malware can detect and either kill or work around.
Sep
21
comment Stack Overflows - Defeating Canaries, ASLR, DEP, NX
Yep, a NOP spray and a NOP sled are exactly the same thing. I've just been playing with heap sprays recently, so I went for the terminology that was on the top of my head.
Sep
21
comment How can I recognize and find file(s) dropped by malware?
API monitors can only identify user-mode calls. If a kernel exploit is utilised, it can drop a rootkit and you'll never know. Plus you have to have a process on the test box, so the malware might identify it and change its behaviour.
Sep
21
reviewed Edit How can I recognize and find file(s) dropped by malware?
Sep
21
revised How can I recognize and find file(s) dropped by malware?
fixed grammar, re-ordered sentences to make them easier to parse, changed title, some formatting.
Sep
21
answered Stack Overflows - Defeating Canaries, ASLR, DEP, NX
Sep
21
awarded  Nice Question