56,767 reputation
17138233
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 8 months
seen 2 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


May
15
comment Is there a full disk encyption software that shows different content depending on what password has beeen used?
@Damon "unknown, undocumented implementation" - BitLocker's crypto design is fully documented. Here's a starting point. Here's some more. You also don't need to use the TPM - mine's deactivated and I run BitLocker in passphrase mode - it's entirely optional to use the TPM. The "startup pin" is also not limited to 68-bit strength - I can't find any reference to this anywhere and would like to know where you found it.
May
15
comment Completely encrypting virtual machine (for free)
Why not just encrypt the host with BitLocker? Or DiskCryptor? Or FreeOTFE?
May
9
comment Bitlocker without TPM with both a startup USB and password?
The USB + PIN mode without a TPM was removed after Vista, iirc, because it was considered to not actually offer any additional security due to the implementation.
May
9
comment PKCS7 vs TLS 1.2 padding
@dave_thompson_085 Yes, this is true. However, check section E.2 at the bottom for information about how SSLv3 acts in SSLv2 compatibility mode - it notes that random padding must be used in that case. This indicates that SSLv3 is expected to potentially do something else for its padding in non-legacy mode - I think the idea was to leave it implementation specific or give rise to tying the padding to cipher suite specifications instead. Either way you're correct, hence why I said it's no detriment in TLS 1.2. It was not a good idea in 1.x or 3.0.
May
8
comment configuring burp to use in proxy environment
@ManojVarma No probs. Don't forget to mark as accepted.
May
8
comment How to make sure that the cryptographic hardware accelerator is being used in am335x?
You're probably better off asking the manufacturer. TI's support is pretty good.
May
8
comment PKCS7 vs TLS 1.2 padding
No. In the case of a message such that len(msg | MAC) % block_size == 0 an entire block of padding is added.
May
8
comment 3rd Party Authentication protocol
@Nimyz 8-bit microcontrollers aren't as flimsy and weak as you might expect. The only thing that stops me running TLS on my Atmega 328P is the fact that it doesn't have enough memory to handle RSA computations on 1024-bit or larger keys. I could probably use an attached SPI/I2C RAM IC for additional memory, but then that'd be much slower, and by that point it's probably just better to use a cheap ARM device with external SRAM instead. Anyway, my advice would be to use HMAC for message signing with a shared secret.
Apr
27
comment XSS with a torrent
@Aatif Also, come to think of it, many torrent clients have a web-based interface. Transmission and Hadouken are headless, so a web interface is a common front-end. uTorrent and Deluge also have optional web interfaces. So it is possible for an XSS condition to arise.
Apr
27
comment XSS with a torrent
@Aatif Some clients use a web renderer such as Microsoft's WebBrowser control. I've come across binary apps which are vulnerable to XSS. Since the code executes in the local security domain it is possible to do stuff like load ActiveX components or VBScript if the local security policy has not been hardened. These can be used to run arbitrary code in the same context as the application process (e.g. create an FSO object, drop data into file, ShellExecute it).
Apr
17
comment Why do some bank websites use passwords that are not case sensitive?
You're more likely to find that the hardware is new (e.g. IBM Power Systems kit), but the OS is a Unix-like distro such as AS/400 which is technically ancient, but still maintained.
Apr
17
comment Why do some bank websites use passwords that are not case sensitive?
Yup, my money is on it being a frontend for an AS/400 or similar.
Apr
15
comment What does this malicious PHP script do?
Right, that's the encoding mechanism. But what's the payload?
Apr
15
comment Malicious Website URL
@CHANist You can, but it can't be blanket blocked for everyone easily if it's just an IP. With a domain it can be killed by the domain provider (e.g. 1and1, Nominet, etc.) based on an abuse report, which means nobody can reach it via that domain any more.
Apr
15
comment Security issues with multiple interfaces
@Stephane Please don't use the close/downvote features for questions where you think the asker is confused or mislead about the situation, when the question itself is on-topic and relatively clear. It's much more constructive to ask for clarifications and provide advice which clears up the confusion than to just dismiss the question.
Apr
15
comment Null Session Questions
@raven A CS student might well think it's a good question, but that doesn't make the question fit for StackExchange. I'm still not really understanding what you're asking - but I'd take a guess that you want to know whether a locally created named pipe can be accessed remotely via SMB, using the Anonymous logon (null session). Did I get that right?
Apr
14
comment How can I confirm I'm vulnerable to OS X “rootpipe” (CVE-2015-1130)?
Also, check if your filesystem is mounted nosuid.
Apr
14
comment How can I confirm I'm vulnerable to OS X “rootpipe” (CVE-2015-1130)?
Did you run id -u to show the effective UID?
Apr
14
comment Email phishing scam asking customers for card details
"Contact gmail" - care to point to where? I'm not sure that they have a generic abuse contact point.
Apr
14
comment Email phishing scam asking customers for card details
First thing: Send out a mass email to your customers explaining that this is happening, warning them NOT to reply to any requests for personal details or financial information via email, and assuring them that you will NEVER ask for such information.