57,555 reputation
17140236
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 9 months
seen Jul 15 at 23:36

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Jan
29
comment Which hard disk encryptions schemes are tied to the original hardware?
I've often heard it described as the standard, and I don't know of another free open-source cross-platform solution that's as pervasive as TC is.
Jan
29
revised How to satisfy requirement 10.6 of PCI DSS?
example
Jan
29
answered How to satisfy requirement 10.6 of PCI DSS?
Jan
29
answered Which hard disk encryptions schemes are tied to the original hardware?
Jan
29
revised What goes into an average incident response process for a corporate network?
clarifications
Jan
29
asked What goes into an average incident response process for a corporate network?
Jan
29
answered Debugging and DLL-Injection
Jan
29
comment default.php file found on the server, is this a security threat?
Ok, I've added an update to include a detailed description of how I de-obfuscated it, and the script I built to do the automatic decryption.
Jan
29
revised default.php file found on the server, is this a security threat?
de-obfuscation info
Jan
29
comment default.php file found on the server, is this a security threat?
@AliAhmad I did it in the sandbox, so I don't have it any more, but I'll write something up.
Jan
29
awarded  Guru
Jan
28
comment default.php file found on the server, is this a security threat?
@Michael Read the comments above yours, I just explained exactly that. Essentially I just replaced each eval with a return until it was fully unpacked.
Jan
28
awarded  Good Answer
Jan
28
comment SSD enrcyption with ATA password - AHCI mode?
Even on an i3, AES is ridiculously lightweight. I run TrueCrypt system encryption on an old P4 box with no issues.
Jan
28
awarded  Enlightened
Jan
28
awarded  Nice Answer
Jan
28
comment Due to which reason might a windows 7 password been reset to empty?
Never underestimate a user's ability to break things in stupid ways :)
Jan
28
comment default.php file found on the server, is this a security threat?
To save me doing it manually, I wrote a script that takes the original script, replaces the eval with a return, then evals that. It then looks at the results and checks if there's another eval at the start. If there is, it loops back and does another replace/eval. If there's no eval at the start of the string, it prints the result, which gives us the final code.
Jan
28
comment default.php file found on the server, is this a security threat?
The eval function executes PHP code passed to it as a string. So the code takes that big base64 string, turns it back into raw binary data using base64_decode, then runs that raw data through gzinflate, since the obfuscator originally ran the data through gzdeflate. So I just replaced the eval with an echo, so it prints out the de-obfuscated string. That operation returns another blob of PHP code that looks similar, with another eval, but actually contains a different base64 blob. If you repeat this over and over, eventually it results in the blob of code I posted.
Jan
28
answered Due to which reason might a windows 7 password been reset to empty?