Reputation
63,325
Next tag badge:
1507/400 score
75/80 answers
Badges
17 155 252
Newest
 Nice Answer
Impact
~2.8m people reached

Sep
1
comment Problems executing shellcode via nop-sled
@raz That's useful too, but an online solution gives you access to both assembly and disassembly on any platform, including phones, from pretty much anywhere. Also, ODA supports almost every modern-ish processor and instruction set ever invented, which is kinda awesome.
Sep
1
comment Problems executing shellcode via nop-sled
@Begueradj This is specific enough to security that it is on-topic here.
Sep
1
comment Problems executing shellcode via nop-sled
On this topic, you can use Defuse x86 online assembler to assemble instructions into bytes online, or do the reverse with ODA Online Disassembler. Both really useful tools for quickly checking how instructions/bytes assemble or disassemble.
Sep
1
comment Problems executing shellcode via nop-sled
@Begueradj How is this off-topic? It's about fixing broken shellcode, which is certainly on-topic here. It's not strictly a single-person fix, because others may also presume that they can use push in stack-based shellcode without it breaking.
Sep
1
answered Problems executing shellcode via nop-sled
Aug
31
comment Definition of security incident
As an example: the IR steps for someone accidentally leaking their AD password over Skype are completely different to the IR steps for a malware outbreak or a physical breach, and they are also different to a breach of PCI infrastructure or a leak of customer data. Certain things need to be reported to regulatory bodies, certain breaches require customers to be notified, certain events require C-level staff to be appraised. A major goal of an IR policy is to define the meaning of "security incident" in the context of the company's different infrastructure segments.
Aug
31
comment Definition of security incident
Schroeder is correct. To be clear, a good IR policy doesn't just state what has to be done, but also defines the circumstances in which actions should be applied, who needs to be notified, the timeframes of each step, and also explains why each of these are important. This gives a context for the person applying the IR policy, so that improvisations can be made should something unusual arise.
Aug
31
comment Definition of security incident
Absolutely anything event that may have negatively impacted the security of an organisation can be considered a "security incident".
Aug
31
comment What security problems are exposed by running untrusted macros in excel?
@NeilSmithline Agreed. It should be made clear that obscurity measures work best against threat actors that are likely to be performing generic attacks against a wide number of people. If your expected threat actor is likely to be tailoring things for you or your organisation specifically, they won't be anywhere near as effective.
Aug
31
answered What security problems are exposed by running untrusted macros in excel?
Aug
31
comment What are the privacy and security implications of Windows Telemetry
Also, the answer to this depends on your settings. The "Basic" option sends back your hardware spec, list of installed programs, and some of your configuration settings in Windows. I don't know the details of what gets sent with other options.
Aug
31
comment What are the privacy and security implications of Windows Telemetry
Switching OS seems a bit drastic. Just disable telemetry entirely.
Aug
24
answered What is a typical defense mechanism/setup against flooding back-end sql calls?
Aug
24
revised BitLocker : Update Volume Master Key and meaning of “keyed” vs “re-keyed”
added more relevant text
Aug
24
comment BitLocker : Update Volume Master Key and meaning of “keyed” vs “re-keyed”
My bad - I somehow misread that entirely. I'll edit that in.
Aug
24
answered BitLocker : Update Volume Master Key and meaning of “keyed” vs “re-keyed”
Aug
21
comment What is the argument for the fairly prevalent “No more than n repeating characters” password rule?
I think the line of thinking is that "Aaaaaaaa9" is a bad password, and preventing repeated characters should stop them from being used. I agree that it's a bad way to go about it though.
Aug
21
awarded  Nice Answer
Aug
21
awarded  Good Answer
Aug
20
awarded  Nice Answer