48,633 reputation
13118208
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 3 years
seen 9 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Oct
26
comment When MBR pirates grin as an indication of absolute pleasure!
Just wipe the disk and start over.
Oct
26
comment Wanting to pursue a career in internet security
Sorry, we don't cover career questions here. Please read the help section for more details on the rules.
Oct
26
comment Is it even possible to hack a television channel?
@EllieKesselman It's from the movie "Hackers", which everyone should definitely see. Cheesy as hell, soundtrack by The Prodigy, stars Angelina Jolie from when she was practically a kid.
Oct
25
comment Secure server. Fast file system decryption
This is way too broad, and it's not clear what you're really asking. StackExchange has rules around the types of questions that can be asked - please familiarise yourself with them.
Oct
25
comment What attacks, if any, are possible against Security Support Provider Interface (SSPI)?
@paj28 Sorry, yes, I should've been more clear. I guess I'm mainly referring to Negotiate and Digest SSP (SASL) as they're the two most common. But, as well as that, I'm interested in the security of how SSPI as an interface safely decides which protocol to use when there are mismatches in support between two endpoints.
Oct
25
comment Is it even possible to hack a television channel?
I would've thought this would be a better clip to pick :)
Oct
23
comment How “enforcable” are email disclaimers
@CarlosBribiescas That is an amusing thought. Sadly, I don't know the answer. It's probably never been tested in court.
Oct
19
comment How do I use “openssl s_client” to test for (absence of) SSLv3 support?
@RogerLipscombe Right, so what's not working there? SSLv3 is not listed, so it's not supported.
Oct
10
comment Add a file as entropy source for /dev/random
Care to explain what specific requirement you have that /dev/urandom doesn't solve? The term "true-random entropy" doesn't make any sense in this context.
Oct
10
comment Add a file as entropy source for /dev/random
You can't really "consume" entropy. Besides, /dev/urandom is designed to provide an essentially unlimited CSRPNG through the use of AES-CTR keyed from /dev/random, which means you're guaranteed to have strong random numbers as long as you've got even a bare minimum of collected entropy. You'd have to run some kind of tiny cut-down kernel on a low-entropy embedded device and pull gigabytes of random data from /dev/urandom to impact security in a negative way.
Oct
10
comment Add a file as entropy source for /dev/random
Can I just ask... why? What is the problem that you are solving by doing this? I mean, "for funsies" is completely fine, I just want to be sure you're not doing it because you expect some kind of tangible security improvement.
Oct
10
comment With RSA, can one ensure that two entities will not have the same private key?
@RickyDemer That is true, though when I said "isn't really defined" I was referring to the fact that (as Stephen pointed out) we don't have a defined, agreed upon function for calculating its true value, short of actually counting all the primes, which defeats the point of the PCF in the first place.
Oct
10
comment Password resets - what practices should web services follow?
@ThomasEyde I'd suggest against that from a usability angle. Not everyone has internet access on their phone.
Oct
7
comment What would one need to do in order to hijack a satellite?
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes.
Oct
6
comment Can AES encryption prevent modifying bits in a wireless protocol?
To be specific, if you choose AES-CBC you'll have block-level malleability allowing you to apply any arbitrary xor tweak to a block (and thus giving you arbitrary modification if you know any plaintext) with the side-effect of corrupting the adjacent block. Or, if you can modify the IV arbitrarily, you can gain xor malleability on the first block with no side-effects. If you choose AES-CTR or any other stream mode, you'll have full xor malleability across the whole stream. So you need authenticity either through MAC or an authenticated mode (e.g. GCM).
Oct
2
comment Does dual boot hurt security?
Easiest references are the malleability article on Wikipedia and this great article on practical exploitation of LUKS in Ubuntu.
Oct
2
comment Does dual boot hurt security?
According to Wikipedia dm-crypt uses CBC by default, so it's vulnerable. There are two main attacks. The first is to just corrupt data blocks, which is possible for any block. The second is to xor ciphertext blocks with a tweak, and that results in the target block's plaintext also being xor'ed with that tweak, and the adjacent block being totally corrupted. This can be useful if you know that a particular bootloader or kernel image is in a specific location on the encrypted disk, because you might be able to modify code.
Oct
2
comment How can I recover files encrypted by Android ransomware?
That's only for CryptoLocker, not any arbitrary ransomware.
Oct
2
comment Does dual boot hurt security?
Caveat: Encrypting your partitions, in most implementations, DOES NOT fully prevent attackers from modifying data on the encrypted disk. Any disk crypto that runs in CBC mode will be vulnerable to block-level xor malleability.
Oct
2
comment Effect on PCI compliance of not checking SSL certificate?
It's probably also worth getting in touch with the PCI Council and mentioning this. You might be one of the first to object to this request, and others may have just gone ahead with it.