52,938 reputation
16125218
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 5 months
seen 57 mins ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Aug
31
comment Remove Password Protection from XLS Document
+1 on this. I discovered how terrible their XLS encryption is on older documents when I was looking into OpenXML. Thankfully the new documents (.xlsx) have a much stronger design.
Aug
31
comment Where does the responsibility lie for a XSS vulnerability
@schroeder Please disclose this vulnerability to the developer immediately. Dropping it here isn't exactly in line with responsible disclosure methods, and there's no way for us to scrub out the details you described, since they're still in the history if we edit. Plus it looks like a cool extension and I'd hate to see it fall into disrepute over something like this.
Aug
31
comment How can attackers bypass firewalls?
@schroeder Not necessarily on the firewall angle. It could be a stateful firewall, at which point it doesn't need any ports open. Only time you need a port open is if you're offering a service, and even then you might limit the source address range for incoming connections. Other than that, though, I agree with you. The military are just people like any others. They still sometimes open email attachments and click on links without thinking. Or get their devices infected and accidently pwn the internal network on BYOD-day.
Aug
31
comment How do I respond to a published security vulnerability in my application?
Stick to what you can find. Others are likely to be less well-known, and often just spider the existing databases of others.
Aug
30
answered How can attackers bypass firewalls?
Aug
30
comment How to make a simple file integrity checker
@user1294101 True, hadn't considered that. Was half asleep when I wrote that comment!
Aug
30
comment How do I respond to a published security vulnerability in my application?
Those vulnerability databases coalesce data from a range of sources, and are often summarised in a hurry when there's a large backlog to go through. The operators of those databases strive for accuracy, though, so they should be more than happy to correct any false information. If you have a patch release notice, you can submit that to them too. Get in touch with them and explain the situation - they should fix the issues pretty quickly.
Aug
30
comment How to make a simple file integrity checker
You could also store a public key in the script, then digitally sign the script (including the embedded public key) and store the resulting signature in a separate file. On startup, the script opens the signature file and verifies it against the script (itself). An attacker cannot forge the signature without your private key.
Aug
30
comment Is it a weakness to be able to see server side scripting?
@Celeritas The critical part here is that the HTML inside the PHP script is just a string. Anything outside of the <?php ?> block is considered direct output. Conversely, anything inside the <?php ?> block is considered code. They key to the whole operation is that PHP is just a scripting language, except instead of showing output on a console or a GUI, it prints out HTML (and other resource types) to a network stream. In C++ you might do printf("User ID is %d\n", userId); and in PHP you might do echo "User ID is {$user_id}<br />\n"; - there's no real difference.
Aug
30
comment Is it a weakness to be able to see server side scripting?
@Celeritas When a browser sends a HTTP request, the server looks for the file name and extracts the extension. It then matches that extension (e.g. php) to an installed extension. In Apache this is somewhat abstracted, since it maps the extension to a MIME type of application/x-httpd-php, which the PHP module then recognises as a PHP script. From there, the PHP engine loads up the script and parses it, then runs it. The PHP code runs, and outputs a document.
Aug
29
comment Worst case scenario of having the ability to remotely write files to disk as admin
@Ramhound I think you misunderstood. "Their program allows files to be written to the disk remotely with administrator privileges." - the process writes the files at the same privilege level as an administrator. It doesn't require admin privileges to log into it.
Aug
29
accepted How secure is NFC on mobile devices?
Aug
29
comment Worst case scenario of having the ability to remotely write files to disk as admin
There's a similar adage for a device with a malware infection: once it's infected, nuke it from orbit and start again - it cannot be trusted.
Aug
29
comment Can you encrypt a password using that password itself?
See security.stackexchange.com/questions/211/… and security.stackexchange.com/questions/17421/how-to-store-salt for guidelines on password storage.
Aug
29
answered Is it a weakness to be able to see server side scripting?
Aug
29
revised Is it a weakness to be able to see server side scripting?
Spelling error.
Aug
28
comment Tools/methods helping to determine application/protocol serving specific port
+1. nmap is one of the simplest and most comprehensive tools out there. Google is also a great tool; just search for port <number>.
Aug
28
comment Encrypt WiFi connection per connected user
@curiousguy Not sure what your point is. I agree that security is often counter to productivity and ease of use, but that's somewhat out of the scope of this question. WPS is a veritable security problem, due to its small keyspace.
Aug
28
answered Password hashing on a load balancing setup
Aug
28
comment Encrypt WiFi connection per connected user
@curiousguy They're flawed in the sense that they allow authenticated clients to read each other's data. Furthermore, the WPS extension makes it trivial to break into WPA/WPA2 networks.