Reputation
63,414
Next tag badge:
1520/400 score
75/80 answers
Badges
17 155 253
Impact
~2.8m people reached

Mar
5
comment Tools helps: First time cracking passwords
I'd have linked the quote to this‌​. (warning: audio)
Mar
4
awarded  Nice Answer
Mar
4
answered Basic Algebra and How it Applies to Information Security?
Mar
4
revised PHP attack string in access logs
bit more coverage of how the initial exploitation works
Mar
4
answered PHP attack string in access logs
Mar
4
revised How to keep using Java 6 securely, despite its unpatch vulnerabilities
Fixed link and added threat-mitigation tag.
Mar
2
comment Necessary education for InfoSec?
Welcome to StackExchange. Unfortunately, your question is highly subjective and is difficult to answer as-is. It also falls under the "too localised" rule, since it's unlikely to apply to anyone else. Please see the FAQ for more details.
Feb
28
reviewed Approve What security risks does Firefox 19's built-in PDF reader (pdf.js) bring?
Feb
28
awarded  Nice Answer
Feb
28
comment Recovering encrypted SD card after Android Factory Reset
Nope. You're pretty much screwed unless you kept a backup of your phone's settings, and even then it might not have backed up the storage key.
Feb
27
comment Are private keys generated by different software packages compatible?
@Frank There are other tools for things like executable signing that use alternative formats.
Feb
27
revised Why do services like Twitter have tokens and secrets for 3rd party apps?
Tags
Feb
27
answered Are private keys generated by different software packages compatible?
Feb
27
comment How high is the entropy of this salt-generating code? (No code-reading actually necessary)
The answers here are good, but I'd like to just make the solution 100% clear - you don't need a strong random number generator, you just need to generate a unique value for a salt. A 32-bit integer that increments per-user, e.g. an auto-increment ID, is completely valid as a salt.
Feb
27
comment How to mitigate SIP Reflection Attacks?
@asadz If I understand the attack properly, it's not a DoS really. It's a password-guessing attack with such ferocity that it ends up causing a DoS condition.
Feb
27
comment How to mitigate SIP Reflection Attacks?
@mgjk You could set up a Python script and pipe tcpdump into it for realtime processing, using a filter so that you only have to process SIP registration requests with the script. From there you could identify high-volume requests and automatically maintain iptables rules based on that. Essentially your own version of fail2ban for your specific case.
Feb
27
comment How to mitigate SIP Reflection Attacks?
@asadz Nope, there's no way for them to tell. Even if they send a packet whose source IP address is spoofed to that of a whitelisted address, they won't receive the response because the network will respond to the spoofed IP. As such, there's no way to enumerate the whitelist.
Feb
27
comment How to predict C rand()?
As I said, there's no such thing as C's rand(). C is a language, and rand() is a function provided by a library for that language. The libraries that are used are entirely dependant on the compiler suite you're using, because the RNG that rand() is based on is not mandated by the spec. You'll need to specify which compiler and libraries you're using.
Feb
27
comment How to predict C rand()?
More links that cover this: Not so random numbers - take 2, Pwning random number generators, State recovery attacks on pseudorandom generators, Predicting values from an LCG
Feb
27
comment How to predict C rand()?
Note that "C rand()" isn't a defined thing as part of the spec. It's entirely dependant on which compiler / libs you're using.