57,535 reputation
17140236
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 9 months
seen Jul 15 at 23:36

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Jan
28
comment Due to which reason might a windows 7 password been reset to empty?
I'm leaning towards user error, unless you have an enforced password policy. You could check the Security event log for the password change audit event.
Jan
28
comment Is Chrome giving out information about me?
"Generally speaking how concerned is Google with privacy?" - be warned that you're going to get very skewed opinions on this one. Different people measure privacy in different ways, and have different ideas about what constitutes a minor or serious violation.
Jan
28
comment default.php file found on the server, is this a security threat?
@CodesInChaos Yeah, though it'd trip most browsers' anti-XSS filters due to the lack of obfuscation. And it's not just RCE that negates the XSS vector, since they can upload arbitrary files too.
Jan
28
revised default.php file found on the server, is this a security threat?
typo
Jan
28
revised Blind SQL injection: understanding heavy queries
link / formatting
Jan
28
comment default.php file found on the server, is this a security threat?
Oh, and props to the Online PHP Functions Sandbox for saving me from having to spin up a VM to de-obfuscate this in.
Jan
28
answered default.php file found on the server, is this a security threat?
Jan
27
comment DPAPI and malware
You're thinking of CryptProtectData. If you call CryptProtectMemory with the CRYPTPROTECTMEMORY_SAME_PROCESS flag set, only the process that protected the memory can unprotect it.
Jan
27
reviewed Reject How to securely hash passwords?
Jan
27
comment Content hashes to help protect resources being fetched from a CDN
@CodesInChaos I don't see it being a major benefit or use-case. If the CDN company made a single account on the site, they could get access to the key and change the data. Not exactly ideal. And if you think I'm being overly paranoid about how far they'll go, then why do you need to encrypt it on the CDN box in the first place?
Jan
27
comment DPAPI and malware
@CodesInChaos You may be right, though it's not clear. The CreateRemoteThread won't work on any process running on a different user account, regardless of ACLs - that's specified in the MSDN docs. From Vista and later, the PROCESS_ALL_ACCESS process access flag also cannot be attained by limited users. The SACL / DACL cannot be set on a process unless you have the rights to it, which might be possible if it's running as the same user. I'm not entirely sure. I think it largely depends on the OS you're running.
Jan
27
comment Can hackers find secret tokens passed to HTTP GET requests?
Yes, that is a caveat, though hard-coding a token like that isn't best practice as you mentioned.
Jan
27
reviewed Edit Can hackers find secret tokens passed to HTTP GET requests?
Jan
27
revised Can hackers find secret tokens passed to HTTP GET requests?
Title
Jan
27
answered Desktop API Security
Jan
27
answered Can hackers find secret tokens passed to HTTP GET requests?
Jan
27
comment DPAPI and malware
@SteveS That's not true. You have to have administrative privileges to inject a thread into a process. As such, if you run as a limited user, two processes running under your user account cannot interfere with each other via injected threads or WriteProcessMemory, unless you grant one of them administrative privileges via UAC escalation.
Jan
27
answered DPAPI and malware
Jan
26
revised Processor microcode manipulation to change opcodes?
added a quick note about changes to instruction parsing
Jan
26
comment Processor microcode manipulation to change opcodes?
Even remapping the instructions would be difficult. An x86 instruction can have prefixes, multi-byte opcodes, etc. Simply shifting bytes around for the opcodes wouldn't work, because they internally map to something useful, e.g. the first few bits might tell the CPU what class of instruction it is (jump, privilege, ALU calc, x86 FPU, MMX, SSE, etc.). Changing these might completely break the control unit, whose job it is to take codes and execute the corresponding microprograms.