Polynomial

32,842 reputation

1067136

bio	website	en.wikipedia.org/wiki/…
	location	United Kingdom
	age	25
visits	member for	1 year, 7 months
	seen	yesterday
stats	profile views	2,043

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.

	32,842 reputation	bio	website	en.wikipedia.org/wiki/…	visits	member for	1 year, 7 months
1067136 badges		location	United Kingdom		seen	yesterday

summary answers questions tags badges favorites bounties reputation activity

1,449 Comments

suggestions reviews revisions comments badges posts accepts all

Mar 29	comment	Cellphone where I don't have to worry about location tracking The edit makes it a little better, agreed.
Mar 29	comment	Cellphone where I don't have to worry about location tracking Product recommendations are off-topic here.
Mar 29	comment	What's an easy way to perform a man-in-the-middle attack on SSL? It'd be nice if you could go through and properly format this for StackExchange. Kinda hard to follow in its current state.
Mar 29	comment	What's an easy way to perform a man-in-the-middle attack on SSL? I always thought Burp was aimed at HTTP(S) traffic, rather than arbitrary underlying data. Also, doesn't it require you to configure the Burp server as a SOCKS proxy on the target machine? I wasn't aware it had any ARP spoofing functionality or other evil jiggery-pokery built in.
Mar 27	comment	How long it will take to crack a RAR password? For anyone wondering the significance of that number, it's just `0x40000`, or 2^18.
Mar 25	comment	Keyloggers - Ports used by keyloggers I think it's a poor heuristic. Just advise the user to keep up to date on OS and software updates, run an AV, and not click dodgy stuff.
Mar 19	comment	Evaluating candidates for Hacker/Pen Test Positions If you're looking to hire a penetration testing contractor in the UK, the standard is CREST accreditation.
Mar 19	comment	Why are GPUs so good at cracking passwords? @lynks It's difficult to directly correlate between the idea of GPU internals and traditional cores, but you could describe each stream processor as a core. I'll admit I didn't realise modern GPUs had so many stream processors though. The main difference is that GPU cores tend to operate in blocks in order to perform a particular task, with certain special bus types joining them together, whereas CPU cores are practically independent.
Mar 19	comment	Why are GPUs so good at cracking passwords? A GPU tends not to have thousands of cores, but hundreds is accurate.
Mar 18	comment	Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network? What has PCI DSS got to do with anything?
Mar 17	comment	Is it safe to sync private keys between iOS devices using iCloud? Sure. But at that point it's probably easier to just get them to type the OAuth token in on each side ;)
Mar 17	comment	When taking ownership of a TPM in Windows 7, how is the SRK derived from the password? Sorry, I meant encryption of stored keys, i.e. encryption of keys added to the TPM rather than "special" keys like the SRK.
Mar 17	comment	csrss.exe process A little clarification: csrss.exe is the Client/Server Runtime SubSystem. On NT5 systems (e.g. XP), a single process handled all requests. In NT6 (e.g. Vista, Win7) this was changed. The session manager subsystem (smss.exe) spawns a csrss process at boot time to handle requests from session 0 processes, i.e. processes owned by the system and not by any logged in user. On a server that doesn't allow interactive users, this will be the only csrss process. When an interactive user logs on, it gets its own csrss process for its session. If 6 users are logged on, there will be 7 csrss processes.
Mar 17	comment	Concrete figures on password cracking in the wild @Gilles Often they're purposefully mis-spelling things to target only the most gullible people.
Mar 16	comment	Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network? Keep in mind that the barrier to entry for development for layer 3 is just having a network card and some software, whereas layer 2 for WiFi requires practically raw access to the 802.11 frames, which means specialised hardware and (usually) special SDR / RF sniffer gear. It's also a significantly younger technology compared to most layer 3 tech, and WiFi is still fast-evolving.
Mar 13	comment	Setting a limit on password recovery attempts If the attacker has his own botnet, a DoS via repeated failed email attempts seems pretty low on your list of problems.
Mar 13	comment	Setting a limit on password recovery attempts I somewhat disagree with the first part - an IP ban isn't trivial to bypass, especially if you're already actively restricting Tor clients.
Mar 11	comment	What statistics can be used to identify pseudorandom data? Yep, that's my primary source of identification. I'm using a set of definitions that match the file extension to known internal data structures and magic numbers.
Mar 11	comment	What statistics can be used to identify pseudorandom data? I'm not as much looking to detect good randomness, as I am looking to detect a lack of non-randomness.
Mar 11	comment	What statistics can be used to identify pseudorandom data? @CodesInChaos x_i is bytes - sorry, the subscript and lowercase is rather confusing. I wanted to use the proper math markup but we don't have it here. It's an implementation taken from a proper stats library, so it is indeed correct.