55,235 reputation
17132226
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 7 months
seen 2 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Aug
31
comment How do I respond to a published security vulnerability in my application?
Stick to what you can find. Others are likely to be less well-known, and often just spider the existing databases of others.
Aug
30
comment How to make a simple file integrity checker
@user1294101 True, hadn't considered that. Was half asleep when I wrote that comment!
Aug
30
comment How do I respond to a published security vulnerability in my application?
Those vulnerability databases coalesce data from a range of sources, and are often summarised in a hurry when there's a large backlog to go through. The operators of those databases strive for accuracy, though, so they should be more than happy to correct any false information. If you have a patch release notice, you can submit that to them too. Get in touch with them and explain the situation - they should fix the issues pretty quickly.
Aug
30
comment How to make a simple file integrity checker
You could also store a public key in the script, then digitally sign the script (including the embedded public key) and store the resulting signature in a separate file. On startup, the script opens the signature file and verifies it against the script (itself). An attacker cannot forge the signature without your private key.
Aug
30
comment Is it a weakness to be able to see server side scripting?
@Celeritas The critical part here is that the HTML inside the PHP script is just a string. Anything outside of the <?php ?> block is considered direct output. Conversely, anything inside the <?php ?> block is considered code. They key to the whole operation is that PHP is just a scripting language, except instead of showing output on a console or a GUI, it prints out HTML (and other resource types) to a network stream. In C++ you might do printf("User ID is %d\n", userId); and in PHP you might do echo "User ID is {$user_id}<br />\n"; - there's no real difference.
Aug
30
comment Is it a weakness to be able to see server side scripting?
@Celeritas When a browser sends a HTTP request, the server looks for the file name and extracts the extension. It then matches that extension (e.g. php) to an installed extension. In Apache this is somewhat abstracted, since it maps the extension to a MIME type of application/x-httpd-php, which the PHP module then recognises as a PHP script. From there, the PHP engine loads up the script and parses it, then runs it. The PHP code runs, and outputs a document.
Aug
29
comment Worst case scenario of having the ability to remotely write files to disk as admin
@Ramhound I think you misunderstood. "Their program allows files to be written to the disk remotely with administrator privileges." - the process writes the files at the same privilege level as an administrator. It doesn't require admin privileges to log into it.
Aug
29
comment Worst case scenario of having the ability to remotely write files to disk as admin
There's a similar adage for a device with a malware infection: once it's infected, nuke it from orbit and start again - it cannot be trusted.
Aug
29
comment Can you encrypt a password using that password itself?
See security.stackexchange.com/questions/211/… and security.stackexchange.com/questions/17421/how-to-store-salt for guidelines on password storage.
Aug
28
comment Tools/methods helping to determine application/protocol serving specific port
+1. nmap is one of the simplest and most comprehensive tools out there. Google is also a great tool; just search for port <number>.
Aug
28
comment Encrypt WiFi connection per connected user
@curiousguy Not sure what your point is. I agree that security is often counter to productivity and ease of use, but that's somewhat out of the scope of this question. WPS is a veritable security problem, due to its small keyspace.
Aug
28
comment Encrypt WiFi connection per connected user
@curiousguy They're flawed in the sense that they allow authenticated clients to read each other's data. Furthermore, the WPS extension makes it trivial to break into WPA/WPA2 networks.
Aug
28
comment How far beyond using Shred should I go when deleting files?
@tylerl It's certainly been asked on SF and SU at some point. On Sec.SE, take your pick: security.stackexchange.com/q/5749/5400 | security.stackexchange.com/q/11313/5400 | security.stackexchange.com/q/5662/5400 | security.stackexchange.com/q/10464/5400 | security.stackexchange.com/q/6133/5400 | security.stackexchange.com/q/11597/5400 | security.stackexchange.com/q/11188/5400 | security.stackexchange.com/q/7069/5400
Aug
28
comment Did I miss anything when checking for passwords?
You probably got them all, then. Unless there's a deleted partition or something.
Aug
28
comment Did I miss anything when checking for passwords?
What else was on the disk? Was it an installed OS?
Aug
28
comment How far beyond using Shred should I go when deleting files?
@GregDolph Answering the latter may be incriminating... ;)
Aug
28
comment Learning IT Security while being paid
@Kao It's difficult to give you one-size-fits-all advice. My suggestion would be to learn a programming language, but not C and certainly not C++. Start with a language like Python. Learn to write decent code in it. Then move onto PHP, and write some horribly insecure webapps! From there you'll start to understand security principles. I'd also suggest reading OWASP for general reference, and CoreLAN for more in-depth native exploit information later.
Aug
28
comment Hash function change
@Earlz bcrypt can be sped up by GPUs, but not by a factor anywhere near that of traditional functions. scrypt is even better, due to the memory-hard function. GPUs may have a large amount of onboard RAM, but the per-core bandwidth chokes performance.
Aug
28
comment How far beyond using Shred should I go when deleting files?
I'm having difficult understanding your question. White flag? Throwing in the towel? With regards to what? In what situation are you using shred? What are your security requirements? Please edit your question to be clearer.
Aug
28
comment Learning IT Security while being paid
Certs can be useful, too. Shell out a few hundred bucks for a CompTIA Security+ to get the absolute basics, then move onto CEH or similar. Just remember that they're only absolute minimums in the security industry, and won't often be taken seriously by employers.