meta user
network profile
| bio | website | en.wikipedia.org/wiki/… |
|---|---|---|
| location | United Kingdom | |
| age | 25 | |
| visits | member for | 1 year, 7 months |
| seen | May 18 at 10:45 | |
| stats | profile views | 2,028 |
Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.
Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly
All answers and comments are encrypted with ROT256-ECB.
Opinions are my own. Advice provided with no warranty.
|
May 8 |
answered | Generic defense againt SQL injection |
|
May 8 |
reviewed | Approve suggested edit on Is it possible for a hacker to download a php file without executing it first? |
|
May 7 |
awarded | Nice Answer |
|
May 7 |
reviewed | Approve suggested edit on diffie-hellman tag wiki excerpt |
|
May 7 |
comment |
How to encrypt data on the server? Tagging devices is incredibly useful for law enforcement if the property is later discovered in a raid. It means you get to have your part in nailing the assholes that stole your gear, and the cops have one less open case file to deal with. You might even get your assets back, though I wouldn't try using them after they've been compromised. |
|
May 7 |
awarded | Nice Answer |
|
May 7 |
answered | Is there any particular reason to use Diffie-Hellman over RSA for key exchange? |
|
May 7 |
comment |
How to encrypt data on the server? My point exactly. Disk crypto alone is no use if someone can get into the BIOS and perform a boot-loader attack, then get you to type the password in. The trick is to provide layers of security. |
|
May 7 |
comment |
Filtering In Iran I wouldn't do too much digging though, especially if an oppressive govm't is watching. |
|
May 7 |
comment |
How does a firewall help to protect a server? +1 for mentioning reverse shells. That's normally something people forget about, and it's one thing I always look for when testing. Essentially, if you get an explicit close back on a port, you can be pretty sure that the firewall allows outbound connections through it. |
|
May 7 |
answered | How to encrypt data on the server? |
|
Apr 30 |
awarded | Notable Question |
|
Apr 30 |
answered | Web application security standards/certificates |
|
Apr 30 |
reviewed | Approve suggested edit on Evasion techiques for WAFs |
|
Apr 30 |
reviewed | Approve suggested edit on CTRL+ALT+DEL Login - Rationale behind it? |
|
Apr 29 |
comment |
What are the most common infection vectors for personal computers? @vlad Thanks for the offer, but sadly mein Deutsch ist sehr schlecht! |
|
Apr 29 |
comment |
How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? As far as patches go, one of the biggest problems in large "100% uptime needed" businesses is change resistance. Bringing down critical systems for patching is expensive and time consuming, and results in having to report smaller numbers to the bosses. So, as such, you'll find that many places lag behind on patches and only do a quarterly patch cycle on critical systems, unless there's a critical service-affecting bug that requires immediate attention. And even then, there's a lot of red-tape and change request politics to go through first. |
|
Apr 29 |
comment |
CTRL+ALT+DEL Login - Rationale behind it? As a side note: when you say it's "wired", what that actually means is that Ctrl+Alt+Del is a mapped to a hardware defined interrupt (set in the APIC, a physical chip on your motherboard). The interrupt was, historically, triggered by the BIOS' keyboard handler routine, but these days it's less clear cut. The interrupt is mapped to an ISR which is executed at ring0, which triggers the OS's internal handler for the event. When no ISR for the interrupt is set, it (usually) causes an ACPI power-cycle event, also known as a hard reboot. |
|
Apr 29 |
answered | .JPEG File upload shell via EXIF comments |
|
Apr 29 |
comment |
TrueCrypt and Keyfiles hidden among 500,000 other .pdf files Consider keyfiles as a "something you have" factor, and treat them in a similar way to an RSA token. The point is that you can keep your keyfiles on your person and refuse to reveal the password on the volume, or take advantage of the plausible deniability of TC's hidden volumes. |
