Reputation
Next tag badge:
684/400 score
78/80 answers
Badges
19 169 265
Newest
 Nice Answer
Impact
~3.1m people reached

Apr
22
comment Unable to overwrite EIP register
@user3006498 I made some edits. Read through and have a try.
Apr
22
comment Can a computer virus be stored somewhere else than on the hard drive?
@slebetman True, but I'd rather have malware on my system that I can detect and appropriately triage than malware on my system that ruins my hardware.
Apr
22
comment Can a computer virus be stored somewhere else than on the hard drive?
@slebetman The difference here is that Stuxnet's payload was designed to interface with a specific PLC device attached to the system. In this case we're talking about generic persistence vectors, not payloads, which is an important distinction. While you might get infected with a piece of malware with such functionality (which would still be unlikely) the chances of it actually being able to "hide" in the intended way are infinitesimal. Similarly, the German powerplant that was infected simply had Stuxnet on a computer that was in the powerplant, and it did not trigger its intended payload.
Apr
22
comment Can a computer virus be stored somewhere else than on the hard drive?
@ViktorToth Yes, but that's somewhat irrelevant when we're talking about risk modeling. It's not as much obscurity as it is limiting the applicability of malware to a very small ecosystem, making it not worth the effort to an attacker unless it's intended to be targeted. Attack economics is an important part of the threat model.
Apr
22
comment What's the difference between the same model with and without FIPS 140 certification?
@MikeOunsworth On the contrary; I suspect they work very similarly to how consumer electronics devices work (especially stuff like routers), whereby one board is produced with pads and traces for all possible components, but some of the components are not populated for certain versions of the device. I suspect that in this realm the HSM devices simply don't include the additional detection hardware, despite being in the same chassis.
Apr
22
comment techniques to detect & mitigate Crypto-ransomware?
@Phillip Honestly, you covered everything off that I'd say, aside from what I commented.
Apr
22
comment techniques to detect & mitigate Crypto-ransomware?
I'd also add: 1) don't use on-system backups as a solution - they need to be physically disconnected. Lots of crypto-ransomware now encrypts volume shadow copies too. 2) enable auditing on your network shares so you can monitor who's accessing what. 3) set up alerting so you can see when a user tries to write lots of files one after the other on a network share, and (if possible) automatically lock them out if the rate is too high. I've seen a customer's SAN hit by cryptolocker and it was a major incident with weeks of downtime. Preventative measures are key.
Apr
22
comment How come I can log in on a random webcam with the password “admin”?
Because they didn't change their credentials from the default. Keep in mind that what you just did is illegal in most jurisdictions, though.
Apr
22
comment What prevents ISPs from tracking chain of proxies' (or Tor relays') IP addresses?
@Mok-KongShen Sure, they can tell you're using Tor. There are ways around this (Tor has settings for people in this situation) but they're not perfect.
Apr
21
comment Challenge/response authentication for garage door opener
@cat Proof of Concept.
Apr
21
comment Challenge/response authentication for garage door opener
@JeffMeden Or just use a rolling code approach with a hash. H(k||c) where k is a shared key and c is an incrementing counter kept track of by both sides. Have the receiver accept any c within a range of 10 of the counter and update when a successful request comes in - this allows the system to continue working even if you press the button a few times out of range of the receiver.
Apr
21
comment Can a computer virus be stored somewhere else than on the hard drive?
Ah yes, I forgot the hard disk firmware from my answer. Travis Goodspeed did an interesting talk on this a while back, producing an anti-forensics disk. The idea was that normal OS read/write and ATA command patterns are pretty unique, but write-blockers, forensics software, and cloners (e.g. dd) send totally different patterns making it easy to spot when a disk is being forensically analysed. The disk then wipes itself with a repeated pattern of the lyrics to Rick Astley's Never Gonna Give You Up.
Apr
21
comment Challenge/response authentication for garage door opener
@DenisDenisovici The delay won't help secure the mechanism at all, and you're in violation of Kerckhoffs' principle. Assume the attacker knows the formula, design your system around that fact. Rate limiting won't help because, as my edit notes, you're passively capturing challenge/response values until you find the value of K (usually the first captured unlock, otherwise certainly the second) at which point you can always impersonate the unlocker perfectly.
Apr
21
comment Challenge/response authentication for garage door opener
@JeffMeden You'd never send an invalid response. You brute-force the value of q locally until you find one which matches a captured C and R pair, and repeat until you have a candidate q value that appears in the results of multiple captured challenge/response pairs. At that point you know K and can produce correct responses just like the real device. The bruteforce approach is just a naive method to get the possible values of q - you're not actually sending any challenges.
Apr
21
comment Can a computer virus be stored somewhere else than on the hard drive?
@Bergi I took the question to exclude traditional mass storage media entirely, but yes, that is true. You can also include smartphones in that category.
Apr
21
comment What's the down side of a dynamic numbered radial keypad?
How, specifically, does this pinpad operate? Is it just the same as a standard numeric pad with the buttons in a circle rather than a grid? Or is there something more clever going on?
Apr
21
comment AES-CTR with PBKDF2 for IV for file archiving at server. Is this ok?
@Michael Your requirement of no attended boot is what makes it impossible. Are you sure you can't just type in a password if the box reboots? Reboots are rare and you can easily have notifications arrive by email if it goes down. Most organisations manage this just fine.
Apr
21
comment AES-CTR with PBKDF2 for IV for file archiving at server. Is this ok?
@Michael You're running into the DRM problem: giving someone the encrypted data and the keys and asking them not to decrypt it. The only half-decent solutions involve stuff like TPMs.
Apr
21
comment AES-CTR with PBKDF2 for IV for file archiving at server. Is this ok?
@Michael If you store the password anywhere, it is compromised as soon as someone gains access to the system. Your files are effectively only obfuscated if you store the password on the system. My advice would be to prompt for the password on startup and cache it in memory until shutdown. If someone gets root on your box they can steal the memory and get the password, but at least it's secure at rest after the system shuts down.
Apr
21
comment Can a computer virus be stored somewhere else than on the hard drive?
The BIOS is certainly writeable by the OS, particularly in UEFI. How do you think userland update tools work?