55,270 reputation
17132226
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 7 months
seen 14 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Apr
12
comment Achieving PFS with public key cryptography
It was just a number I pulled from the air that wouldn't cause any tangible harm to security should it be taken literally. Feel free to replace it to fit your security bound.
Apr
7
comment Create a unterminable process in Windows
@HarryJohnston Nice find. I'll include it in the answer.
Apr
1
comment How to convince my management of a physical security risk?
@RoryAlsop FC's talks are never recorded, unfortunately. Makes sense, as he wants to minimise the number of people who know what he looks like.
Mar
29
comment Why Adobe is recommending McAfee security scan during flash player installation?
@Pacerier It's a reference to a scene from Spaceballs.
Mar
23
comment Can a Trojan hide itself, so its activity doesn't appear in task manager process?
@DanNeely Process Monitor, as far as I understand, doesn't bother with the toolhelp functions and goes straight to the ntdll stuff, so hooking Process32First/Next won't beat it. Hooking NtQuerySystemInformation should still hide it from ProcExp, as should anything lower down. You'd have to do investigation with a kernel debugger (e.g. WinDbg) to identify hooks at that level. Hidden EPROCESS entries require some more in-depth analysis. Stuff like SSDT / IDT hooks will require forensic memory dumps.
Mar
23
comment Safely encrypting data received through HTTPS
@StijnFrishert Then rethink your security model. You're trying to invent a DRM system, which is a fatally flawed premise. The user's computer is theirs to control. If your security model involves treating it as trusted (it isn't) then your security model is wrong. More specifically: if the data is ever read or acted upon on the user's computer, then that data (and the code) is theirs to modify, thereby entirely bypassing your security controls.
Mar
23
comment Safely encrypting data received through HTTPS
Ok. Part 3 confuses me a little - who needs to access the data? What's your threat model?
Mar
23
comment Safely encrypting data received through HTTPS
What OS are you doing this on?
Mar
23
comment OpenSSL: Allow CBC ciphers for TLS but prevent for SSL3
Can you post what you're passing to that function? From my understanding, there are two ways to do it: (1) use the - prefix to disable the block ciphers (AES, DES3, etc.) then follow it by +TLSv1+TLSv1.2 and then more - prefixed strings to disable any ciphers globally (e.g. export), or (2) manually maintain a list of full cipher strings with flags about when they should or shouldn't be enabled, and build a full list from that depending on options.
Mar
23
comment OpenSSL: Allow CBC ciphers for TLS but prevent for SSL3
How exactly are you disabling CBC-mode ciphers?
Mar
23
comment Can a Trojan hide itself, so its activity doesn't appear in task manager process?
@CodeClown All of these hooks require the attacking process to be running as an administrator. The latter ones require driver load privileges. The solution is not to run malicious code on your system - follow safe practices, enable UAC, use a VM / sandboxing for testing untrusted stuff, run an AV (MSSE is fine), and install and configure EMET to get some additional protection against exploits.
Mar
23
comment Can a Trojan hide itself, so its activity doesn't appear in task manager process?
@CodesInChaos Yup, though it's is easy to detect by enumerating the thread list (ETHREAD structs) and intersecting the parent process ID list with those obtained from the EPROCESS list. If there are any orphaned threads, you know there's a hidden process. You can't (trivially) unlink threads because the thread scheduler won't give them any CPU time, making them generally useless.
Mar
23
comment Can a Trojan hide itself, so its activity doesn't appear in task manager process?
@CodeClown Not really depressing. All of these ways are trivially detected from a forensic memory dump. There are automated tools that can detect for these anomalies. It gets even more fun when there are filter drivers in place to hide files and registry keys.
Mar
23
comment Can a Trojan hide itself, so its activity doesn't appear in task manager process?
@CodesInChaos Ah, yes, I see what you're saying there. Same thing goes for CreateRemoteThread, though in both cases you can dump the modules list / thread list and investigate that way (all easy with Process Explorer).
Mar
23
comment Can a Trojan hide itself, so its activity doesn't appear in task manager process?
@CodesInChaos Injecting a DLL simply allows the hooks to be inserted within the process more easily, as the code already exists. The alternative vector is to use VirtualAllocEx / WriteProcessMemory / VirtualProtectEx / CreateRemoteThread to either inject code and a new running thread to patch the IAT, or directly patch the IAT with "remotely" allocated code caves, without creating the remote thread.
Mar
23
comment Would Insecure Direct References and SQL Injection be solved by using Row-Level Security and Per-User Connection Strings?
@NeilMcGuigan Well, for a start, you need a mechanism to provision those accounts. Which means your provisioning user needs the ability to create new users and set their privileges - not ideal. What situation are you running into with "dynamic identifiers"? Every time I've heard that problem, it's been a use-case for a non-relational database (e.g. Redis / MongoDb) or a misunderstanding of constraints / normal form.
Mar
22
comment Is it unwise to use Redis to store PII, private keys, and other secrets?
While I understand the need for risk analysis, surely the solution here isn't doing away with Redis, but rather using hardware that is known-safe against Rowhammer? It seems that modern UEFI patches are decreasing the DRAM refresh timings, and there's currently no known practical attack against ECC.
Mar
22
comment Are there different degrees of “confidentiality”? What is the best way for a psychologist to maintain confidentiality of communications with patients?
Yup. Pretty much.
Mar
20
comment Are there different degrees of “confidentiality”? What is the best way for a psychologist to maintain confidentiality of communications with patients?
@StanShunpike I wouldn't rank them in any order - they're all insecure. Don't use any of them to send patient information. The exception is if you're sending emails encrypted (e.g. with PGP) but this doesn't sound appropriate for what you're doing.
Mar
20
comment I have registered a .com domain and received an e-mail from domainadmin.com
Feel free to draw your own conclusions. Mine is that it's legit.