53,817 reputation
17130221
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 6 months
seen 2 days ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Mar
19
comment Is android's FDE secure from offline attacks?
Last I checked, Android doesn't support FDE unless you have passphrase locking enabled. I've tested on KitKat (4.4.2) and Ice Cream Sandwich (4.0.4) and neither supported FDE with a 6-digit PIN; the encryption wizard forced me to switch the lock mode before allowing encryption.
Mar
16
comment Session Fixation - Is that even an issue here?
@Mercious You can never be 100% sure that you didn't miss something. Everything has bugs, and you might not even be responsible for the bug that results in XSS (or a similar impact) on your site. As I noted, SOP bypass bugs in browsers are relatively common, so you should account for them where possible. Besides, the fix for session fixation on login is just to regenerate the token on login - it's not a lot of work.
Mar
16
comment Session Fixation - Is that even an issue here?
@Mercious You're also presuming that the user's browser is without bugs. What if there's a same-origin policy violation bug in the user's browser, and an attacker leverages it to create a cookie across origins onto your domain? With your session fixation issue present, your user's account gets hijacked. If you fix that bug, they're not quite so boned.
Mar
16
comment Session Fixation - Is that even an issue here?
@Mercious Major, major flaw in your thinking: XSS doesn't have to be from standard user input. It could be from the Referer, the URI itself, HTTP headers, external content (e.g. included jquery.js), or even DOM-based from some dodgy JavaScript. Your filters may also be defective, ineffective against certain character classes (UTF-8, etc.), or not have 100% coverage. You should never presume that XSS will not be a problem.
Mar
10
comment How can I explain SQL injection without technical jargon?
@Kyralessa Perhaps it houses its charging port ;]
Mar
7
comment Are there / have there ever been viruses that completely evade virus scanners for very long?
Sorry, I should've been more clear. From memory, one of the major internet watch organisations stated that they'd found packets from 2011 which looked like someone trying out the same bug, but they couldn't be sure. Shellshock is thought to have been used by a small botnet in 2012, though the bot developers may not have known how significant their find was.
Mar
6
comment How is DDoS possible if you're not listening to the DoS traffic?
CloudFlare also has the benefit of being able to use anycast routing to distribute the load of the attack away from the target - a luxury you don't have at the ISP level, let alone at your router.
Mar
6
comment How can I securely delete items in a database?
There's no way to recover it from the database itself - there's no UNDELETE or similar. The only way to get at the deleted data is to read the database file on disk and extract latent data.
Mar
6
comment Can video feed be used to track location of an IP?
It's also worth noting that if your adversary has privileged information, e.g. access to your traffic, most proxy solutions (e.g. HTTP or SOCKS proxies) will not protect you. A VPN solution is more appropriate if you're using an untrusted network (e.g. hotel wifi) or are worried about your ISP seeing what you're doing.
Mar
6
comment Certificate verification
This is very vague. What kind of certificates? x509 client certs? What do you mean by "if the certificate is accepted by the system"? You also haven't said what kind of validation you're expecting to be done on the client - is this something you want to do programmatically inside an application, or with a standalone tool? Please go back and edit your question to provide more detail.
Mar
5
comment Is plain text over https really a good idea?
This is what authentication models such as CHAP attempt to solve. Implementing your own solution is ill-advised, though.
Mar
5
comment IDS over HTTPS connection
Normally, in corporate environments, the users' browsers are set up to trust a CA ran by the business. That way they can install a CA private key in the SSL endpoint and re-sign the traffic.
Mar
5
comment POODLE and TLS…not SSL
Oh, joy. Time to go update our standard recommendations then! Maybe we'll get a sensible TLS spec by 2035.
Mar
5
comment POODLE and TLS…not SSL
My bad - I honestly thought it was encrypt-then-MAC. Why are we still using that crappy construction!? shakes head ... Also, does that mean I'm wrong then? POODLE can still work against TLS1.1/1.2 if they do the padding badly?
Mar
5
comment What does this PHP injected-code do?
There was a race condition bug recently that I remember had similar looking code to this for its PoC - specifically the use of setInterval/clearInterval. Perhaps it's trying to pop your users?
Mar
5
comment Place database in the DMZ and in the internal network
Sorry, but this is a horrible answer. If you're going to propose something radical like "do away with security boundaries" then you sure as hell better have some strong justification. Also, "you should be safe from attackers" without quantification as to a threat model is very dangerous assurance to give.
Feb
21
comment Android 5 encryption
@raz They use the same algorithm in principal, but /dev/urandom will continue to provide random numbers even when the internal entropy counter is zero. This means that there's a potential, theoretical, minor reduction in security when using /dev/urandom. However, it should almost never matter in practice unless you're using the random numbers in a way that makes them particularly fragile in terms of cryptanalysis, and your attacker has an incredibly high level of skill and resources.
Feb
20
comment different IP addresses
Your question is not about information security as defined by this article, and as such it is off-topic here.
Feb
19
comment Are secret URLs secure over HTTPS?
@Bruno Are you sure about that? I was under the impression that modern browsers don't leak the referrer between entities as per the Same Origin Policy (SOP).
Feb
2
comment How to perform SQL injection with real_escape_string filter in place?
Yup, if you can inject 1 or 1=1 then you can (probably) inject the union.