56,805 reputation
17138233
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 8 months
seen yesterday

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Jan
29
comment default.php file found on the server, is this a security threat?
@AliAhmad I did it in the sandbox, so I don't have it any more, but I'll write something up.
Jan
29
awarded  Guru
Jan
28
comment default.php file found on the server, is this a security threat?
@Michael Read the comments above yours, I just explained exactly that. Essentially I just replaced each eval with a return until it was fully unpacked.
Jan
28
awarded  Good Answer
Jan
28
comment SSD enrcyption with ATA password - AHCI mode?
Even on an i3, AES is ridiculously lightweight. I run TrueCrypt system encryption on an old P4 box with no issues.
Jan
28
awarded  Enlightened
Jan
28
awarded  Nice Answer
Jan
28
comment Due to which reason might a windows 7 password been reset to empty?
Never underestimate a user's ability to break things in stupid ways :)
Jan
28
comment default.php file found on the server, is this a security threat?
To save me doing it manually, I wrote a script that takes the original script, replaces the eval with a return, then evals that. It then looks at the results and checks if there's another eval at the start. If there is, it loops back and does another replace/eval. If there's no eval at the start of the string, it prints the result, which gives us the final code.
Jan
28
comment default.php file found on the server, is this a security threat?
The eval function executes PHP code passed to it as a string. So the code takes that big base64 string, turns it back into raw binary data using base64_decode, then runs that raw data through gzinflate, since the obfuscator originally ran the data through gzdeflate. So I just replaced the eval with an echo, so it prints out the de-obfuscated string. That operation returns another blob of PHP code that looks similar, with another eval, but actually contains a different base64 blob. If you repeat this over and over, eventually it results in the blob of code I posted.
Jan
28
answered Due to which reason might a windows 7 password been reset to empty?
Jan
28
comment Due to which reason might a windows 7 password been reset to empty?
I'm leaning towards user error, unless you have an enforced password policy. You could check the Security event log for the password change audit event.
Jan
28
comment Is Chrome giving out information about me?
"Generally speaking how concerned is Google with privacy?" - be warned that you're going to get very skewed opinions on this one. Different people measure privacy in different ways, and have different ideas about what constitutes a minor or serious violation.
Jan
28
comment default.php file found on the server, is this a security threat?
@CodesInChaos Yeah, though it'd trip most browsers' anti-XSS filters due to the lack of obfuscation. And it's not just RCE that negates the XSS vector, since they can upload arbitrary files too.
Jan
28
revised default.php file found on the server, is this a security threat?
typo
Jan
28
revised Blind SQL injection: understanding heavy queries
link / formatting
Jan
28
comment default.php file found on the server, is this a security threat?
Oh, and props to the Online PHP Functions Sandbox for saving me from having to spin up a VM to de-obfuscate this in.
Jan
28
answered default.php file found on the server, is this a security threat?
Jan
27
comment DPAPI and malware
You're thinking of CryptProtectData. If you call CryptProtectMemory with the CRYPTPROTECTMEMORY_SAME_PROCESS flag set, only the process that protected the memory can unprotect it.
Jan
27
reviewed Reject How to securely hash passwords?