meta user
network profile
| bio | website | en.wikipedia.org/wiki/… |
|---|---|---|
| location | United Kingdom | |
| age | 25 | |
| visits | member for | 1 year, 7 months |
| seen | May 18 at 10:45 | |
| stats | profile views | 2,027 |
Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.
Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly
All answers and comments are encrypted with ROT256-ECB.
Opinions are my own. Advice provided with no warranty.
|
Nov 8 |
revised |
How can vending machines be hacked? And how can I prevent it? added 232 characters in body |
|
Nov 8 |
answered | How can vending machines be hacked? And how can I prevent it? |
|
Nov 8 |
comment |
Attacking an office printer? @mikebabcock Keep in mind that some printers don't use 9100, so you might not need anything other than 515. Of course, you may also need to temporarily allow inbound connections to port 80 if you're changing printer settings. |
|
Nov 7 |
comment |
Getting automatically logged in to others session via WIFI Sadly the state of most countries' critical telecommunications infrastructure security is pretty terrible. I recently heard a story from a pentester who was tasked with breaking into a large mobile (cellphone) network in the UK, which he managed by picking the lock on a cell tower gate and plugging an ethernet cable into the cabinet's switch. It was on the internal network and implicitly trusted, and they had thousands of these sites nationwide. Apparently they have some mitigations in place now, but it's still scary. |
|
Nov 7 |
comment |
Exposure risk of knowing only social security number? The trick is that you usually need to know the person's name and SSN as a minimum, and often a date of birth too. As such, randomly guessing SSNs doesn't really make much sense. |
|
Nov 7 |
comment |
Can a whitespace regex character be used to perform a javascript injection? You're "protecting" from XSS via client-side JavaScript? Er... I think you're doing it wrong. |
|
Nov 7 |
answered | Getting automatically logged in to others session via WIFI |
|
Nov 7 |
comment |
UPS my choice — How can I access my public records? They're probably pulling it from Experian, but I'd be interested to know how they know what year you graduated in. You can always ask them what source they got the data from, since it's your right (at least in the UK, anyway, due to DPA 1988). |
|
Nov 7 |
comment |
Passwords In Securing Network Devices @Glenn1234 The spaces thing refers to spaces at the start or end of the password, which Linux/Unix do silly things with. If you're coming across limitations with symbols, these are vendor-specific failures. TKIP fully supports ASCII symbols in passwords. |
|
Nov 7 |
answered | What type of attacks can be used vs MongoDB? |
|
Nov 7 |
comment |
Malicious PHP code can run in cache. Solution? @EfazAÑecohJ-ra Sphinx is an indexing engine allowing for fast searches of data, but it doesn't cache the data itself. |
|
Nov 7 |
answered | Malicious PHP code can run in cache. Solution? |
|
Nov 7 |
revised |
Malicious PHP code can run in cache. Solution? formatting / tags |
|
Nov 7 |
comment |
Attacking an office printer? @hsnm Not too difficult for obvious stuff - should your printer be allowed to initiate outgoing TCP connections? Should your printer be allowed to perform DNS queries? Do you really need to allow UPnP and SNMP traffic to reach it? |
|
Nov 7 |
comment |
Key Exchange using PKI Ah, I seem to have misunderstood. |
|
Nov 7 |
comment |
Attacking an office printer? Alternatively, whitelist the IP netblock of the manufacturer and firewall the rest off. |
|
Nov 7 |
comment |
Attacking an office printer? This applies to print servers too, which have a habit of being web-accessible. |
|
Nov 7 |
comment |
Online security check via command line Avoid ShieldsUP - it's generally hocus-pocus. Furthermore, Steve Gibson is a known infosec charlatan. There was even an entire website dedicated to debunking his marketing hype and sci-fi security gibberish. |
|
Nov 7 |
comment |
Encryption in an embeddded system Don't be so sure about attackers not modding your firmware. Vending machines (and similar devices) can often be pwned via buffer overflows on all sorts of easily accessible interfaces. |
|
Nov 7 |
answered | Passwords In Securing Network Devices |
