Reputation
Next tag badge:
655/400 score
76/80 answers
Badges
19 169 262
Newest
 Nice Answer
Impact
~3.1m people reached

Apr
24
comment How difficult is it to brute-force Windows EFS encryption?
@RickyDemer So what? This is not the location for this conversation.
Apr
24
comment security authentication protocol
Please edit your question to actually explain the protocol. Your notation uses a seemingly invented form that is very difficult to read and understand. You need to properly define the protocol in order for it to be properly understood.
Apr
24
comment Would it be possible to fix the security flaws inherent in USB technology?
@Francesco I'm leaning towards closing this question as you've not specified any actual attacks against USB, so it's incredibly broad. For example, with access to a USB port I might present a keyboard/mouse/display/NIC combo and take over your system, exploit driver bugs to take over your box, or feed 1kV into it and fry your board. Are these what you're thinking of? What's your threat model?
Apr
24
comment Would it be possible to fix the security flaws inherent in USB technology?
This would largely invalidate the 'U' in USB.
Apr
24
comment security authentication protocol
You're going to have to re-write that protocol explanation. Your first line says "the client sends the client to the server", which doesn't make any sense. You're better off writing it out in text than trying to write notation. Also, you need to define what "crypted" means.
Apr
24
comment What prevents ISPs from tracking chain of proxies' (or Tor relays') IP addresses?
@Mok-KongShen They are informed of this fact. It's in the Tor FAQ.
Apr
24
comment What's the difference between the same model with and without FIPS 140 certification?
@SEJPM It's an educated guess based on the fact that I've taken a decent range of chip & pin EMV machines apart, and they do the same thing. Different models of machines in the same series tend to maintain the same security control but have unpopulated sections depending on feature support, all using the same board. As an example, two VeriFone devices I pulled apart had the exact same board, except one had a breakout for a WiFi module and some additional supporting power components for it. These were unpopulated in the cheaper wired model.
Apr
24
comment Unable to overwrite EIP register
@user3006498 Unfortunately I can't really help much without an interactive session with your environment. My advice would be to trace through and look at exactly what gets put on the stack, and what code branches get taken when you change the values from 'A' to '\xA0'.
Apr
24
comment Can a computer virus be stored somewhere else than on the hard drive?
@forest If you infect these areas you can implement malware with specific capabilities. For example, infecting a NIC's firmware gives you DMA access to the entire system memory, and a covert exfiltration channel that can't be seen by the OS. GPU malware can again DMA, so it has full control over the system, although it can't directly communicate out (well, actually, it can, if you hook up an internet-connected TV via HDMI, due to HEC). GPUs also have firmware. Point being that these places store code, and modifying that code allows for a persistent stealthy rootkit.
Apr
22
comment Can a computer virus be stored somewhere else than on the hard drive?
@rugk This is almost impossible to do without ever touching the disk, though. While attempts have been made, issues like paging and having to drop libraries to inject into the processes into temporary directories, ultimately means that memory-resident malware is often not entirely memory-resident.
Apr
22
comment Unable to overwrite EIP register
@user3006498 I made some edits. Read through and have a try.
Apr
22
comment Can a computer virus be stored somewhere else than on the hard drive?
@slebetman True, but I'd rather have malware on my system that I can detect and appropriately triage than malware on my system that ruins my hardware.
Apr
22
comment Can a computer virus be stored somewhere else than on the hard drive?
@slebetman The difference here is that Stuxnet's payload was designed to interface with a specific PLC device attached to the system. In this case we're talking about generic persistence vectors, not payloads, which is an important distinction. While you might get infected with a piece of malware with such functionality (which would still be unlikely) the chances of it actually being able to "hide" in the intended way are infinitesimal. Similarly, the German powerplant that was infected simply had Stuxnet on a computer that was in the powerplant, and it did not trigger its intended payload.
Apr
22
comment Can a computer virus be stored somewhere else than on the hard drive?
@ViktorToth Yes, but that's somewhat irrelevant when we're talking about risk modeling. It's not as much obscurity as it is limiting the applicability of malware to a very small ecosystem, making it not worth the effort to an attacker unless it's intended to be targeted. Attack economics is an important part of the threat model.
Apr
22
comment What's the difference between the same model with and without FIPS 140 certification?
@MikeOunsworth On the contrary; I suspect they work very similarly to how consumer electronics devices work (especially stuff like routers), whereby one board is produced with pads and traces for all possible components, but some of the components are not populated for certain versions of the device. I suspect that in this realm the HSM devices simply don't include the additional detection hardware, despite being in the same chassis.
Apr
22
comment techniques to detect & mitigate Crypto-ransomware?
@Phillip Honestly, you covered everything off that I'd say, aside from what I commented.
Apr
22
comment techniques to detect & mitigate Crypto-ransomware?
I'd also add: 1) don't use on-system backups as a solution - they need to be physically disconnected. Lots of crypto-ransomware now encrypts volume shadow copies too. 2) enable auditing on your network shares so you can monitor who's accessing what. 3) set up alerting so you can see when a user tries to write lots of files one after the other on a network share, and (if possible) automatically lock them out if the rate is too high. I've seen a customer's SAN hit by cryptolocker and it was a major incident with weeks of downtime. Preventative measures are key.
Apr
22
comment How come I can log in on a random webcam with the password “admin”?
Because they didn't change their credentials from the default. Keep in mind that what you just did is illegal in most jurisdictions, though.
Apr
22
comment What prevents ISPs from tracking chain of proxies' (or Tor relays') IP addresses?
@Mok-KongShen Sure, they can tell you're using Tor. There are ways around this (Tor has settings for people in this situation) but they're not perfect.
Apr
21
comment Challenge/response authentication for garage door opener
@cat Proof of Concept.