Reputation
Next tag badge:
679/400 score
78/80 answers
Badges
19 169 264
Newest
 aes
Impact
~3.1m people reached

Apr
24
comment What's the difference between the same model with and without FIPS 140 certification?
@SEJPM It's an educated guess based on the fact that I've taken a decent range of chip & pin EMV machines apart, and they do the same thing. Different models of machines in the same series tend to maintain the same security control but have unpopulated sections depending on feature support, all using the same board. As an example, two VeriFone devices I pulled apart had the exact same board, except one had a breakout for a WiFi module and some additional supporting power components for it. These were unpopulated in the cheaper wired model.
Apr
24
comment Unable to overwrite EIP register
@user3006498 Unfortunately I can't really help much without an interactive session with your environment. My advice would be to trace through and look at exactly what gets put on the stack, and what code branches get taken when you change the values from 'A' to '\xA0'.
Apr
24
comment Can a computer virus be stored somewhere else than on the hard drive?
@forest If you infect these areas you can implement malware with specific capabilities. For example, infecting a NIC's firmware gives you DMA access to the entire system memory, and a covert exfiltration channel that can't be seen by the OS. GPU malware can again DMA, so it has full control over the system, although it can't directly communicate out (well, actually, it can, if you hook up an internet-connected TV via HDMI, due to HEC). GPUs also have firmware. Point being that these places store code, and modifying that code allows for a persistent stealthy rootkit.
Apr
22
comment Can a computer virus be stored somewhere else than on the hard drive?
@rugk This is almost impossible to do without ever touching the disk, though. While attempts have been made, issues like paging and having to drop libraries to inject into the processes into temporary directories, ultimately means that memory-resident malware is often not entirely memory-resident.
Apr
22
comment Unable to overwrite EIP register
@user3006498 I made some edits. Read through and have a try.
Apr
22
revised Unable to overwrite EIP register
added 3274 characters in body
Apr
22
answered How difficult is it to brute-force Windows EFS encryption?
Apr
22
awarded  Great Answer
Apr
22
answered Unable to overwrite EIP register
Apr
22
comment Can a computer virus be stored somewhere else than on the hard drive?
@slebetman True, but I'd rather have malware on my system that I can detect and appropriately triage than malware on my system that ruins my hardware.
Apr
22
revised Encryption and compression of Data
added 453 characters in body
Apr
22
comment Can a computer virus be stored somewhere else than on the hard drive?
@slebetman The difference here is that Stuxnet's payload was designed to interface with a specific PLC device attached to the system. In this case we're talking about generic persistence vectors, not payloads, which is an important distinction. While you might get infected with a piece of malware with such functionality (which would still be unlikely) the chances of it actually being able to "hide" in the intended way are infinitesimal. Similarly, the German powerplant that was infected simply had Stuxnet on a computer that was in the powerplant, and it did not trigger its intended payload.
Apr
22
comment Can a computer virus be stored somewhere else than on the hard drive?
@ViktorToth Yes, but that's somewhat irrelevant when we're talking about risk modeling. It's not as much obscurity as it is limiting the applicability of malware to a very small ecosystem, making it not worth the effort to an attacker unless it's intended to be targeted. Attack economics is an important part of the threat model.
Apr
22
revised What's the difference between the same model with and without FIPS 140 certification?
added 1141 characters in body
Apr
22
comment What's the difference between the same model with and without FIPS 140 certification?
@MikeOunsworth On the contrary; I suspect they work very similarly to how consumer electronics devices work (especially stuff like routers), whereby one board is produced with pads and traces for all possible components, but some of the components are not populated for certain versions of the device. I suspect that in this realm the HSM devices simply don't include the additional detection hardware, despite being in the same chassis.
Apr
22
revised What's the difference between the same model with and without FIPS 140 certification?
added 672 characters in body
Apr
22
answered What's the difference between the same model with and without FIPS 140 certification?
Apr
22
comment techniques to detect & mitigate Crypto-ransomware?
@Phillip Honestly, you covered everything off that I'd say, aside from what I commented.
Apr
22
comment techniques to detect & mitigate Crypto-ransomware?
I'd also add: 1) don't use on-system backups as a solution - they need to be physically disconnected. Lots of crypto-ransomware now encrypts volume shadow copies too. 2) enable auditing on your network shares so you can monitor who's accessing what. 3) set up alerting so you can see when a user tries to write lots of files one after the other on a network share, and (if possible) automatically lock them out if the rate is too high. I've seen a customer's SAN hit by cryptolocker and it was a major incident with weeks of downtime. Preventative measures are key.
Apr
22
answered Very long HEAD request in server logs: What is the intention?