56,870 reputation
17138233
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 9 months
seen yesterday

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Jan
27
comment Content hashes to help protect resources being fetched from a CDN
@CodesInChaos I don't see it being a major benefit or use-case. If the CDN company made a single account on the site, they could get access to the key and change the data. Not exactly ideal. And if you think I'm being overly paranoid about how far they'll go, then why do you need to encrypt it on the CDN box in the first place?
Jan
27
comment DPAPI and malware
@CodesInChaos You may be right, though it's not clear. The CreateRemoteThread won't work on any process running on a different user account, regardless of ACLs - that's specified in the MSDN docs. From Vista and later, the PROCESS_ALL_ACCESS process access flag also cannot be attained by limited users. The SACL / DACL cannot be set on a process unless you have the rights to it, which might be possible if it's running as the same user. I'm not entirely sure. I think it largely depends on the OS you're running.
Jan
27
comment Can hackers find secret tokens passed to HTTP GET requests?
Yes, that is a caveat, though hard-coding a token like that isn't best practice as you mentioned.
Jan
27
reviewed Edit Can hackers find secret tokens passed to HTTP GET requests?
Jan
27
revised Can hackers find secret tokens passed to HTTP GET requests?
Title
Jan
27
answered Desktop API Security
Jan
27
answered Can hackers find secret tokens passed to HTTP GET requests?
Jan
27
comment DPAPI and malware
@SteveS That's not true. You have to have administrative privileges to inject a thread into a process. As such, if you run as a limited user, two processes running under your user account cannot interfere with each other via injected threads or WriteProcessMemory, unless you grant one of them administrative privileges via UAC escalation.
Jan
27
answered DPAPI and malware
Jan
26
revised Processor microcode manipulation to change opcodes?
added a quick note about changes to instruction parsing
Jan
26
comment Processor microcode manipulation to change opcodes?
Even remapping the instructions would be difficult. An x86 instruction can have prefixes, multi-byte opcodes, etc. Simply shifting bytes around for the opcodes wouldn't work, because they internally map to something useful, e.g. the first few bits might tell the CPU what class of instruction it is (jump, privilege, ALU calc, x86 FPU, MMX, SSE, etc.). Changing these might completely break the control unit, whose job it is to take codes and execute the corresponding microprograms.
Jan
26
comment Content hashes to help protect resources being fetched from a CDN
If it were so sensitive, it wouldn't (and shouldn't) be on a 3rd party CDN anyway.
Jan
26
answered Processor microcode manipulation to change opcodes?
Jan
26
answered Is a company responsible for a spam which mentions it?
Jan
26
accepted Content hashes to help protect resources being fetched from a CDN
Jan
26
comment Content hashes to help protect resources being fetched from a CDN
@Matrix If it's encrypted on the CDN server, the client has to know how to decrypt it. Therefore anyone who visits the site has to know the key to decrypt the file, including anyone from the CDN company that visits the site.
Jan
25
comment Content hashes to help protect resources being fetched from a CDN
@AJHenderson That's a naive view. Web servers like IIS and Apache have quite high overheads for sending small static files, whereas servers like nginx are optimised for serving static files extremely efficiently. Furthermore, configuring the server for high performance on both content delivery, database access, and web applications is difficult. For performance on a large site, it makes sense to split those functions out, so that the system configuration and server daemons can be optimised for a single function. Caching is already done on dynamic pages, but some things just can't be cached.
Jan
25
comment How Involved Should a Developer Be in Designing a Security Policy?
Look at a protocol like SSL. There are a hundred different flags that alter a hundred different behaviours, with a hundred different cipher suites. All of those have to work, and all of them need to be fully configurable. Getting that right is a software architecture exercise, not a security exercise.
Jan
25
comment How Involved Should a Developer Be in Designing a Security Policy?
That's a tricky situation, and it works with features and product behaviour too. In fact, it's not really a security issue. For example, one customer might want a set of records in an ERP app to be consolidated into a report with one particular rounding discrepancy calculation, whereas another customer might want to use a different calculation. Your job is to architect the software in a way that enables you to provide modular functionality that can be enabled, disabled or altered based on per-customer config switches. It's about strong and flexible architecture.
Jan
25
comment Content hashes to help protect resources being fetched from a CDN
@Matrix That wouldn't work. If the client can decrypt it, the CDN operators can decrypt it too. Also, HTTPS for transport security is often avoided on CDNs due to performance and caching issues.