Reputation
67,671
Next tag badge:
657/400 score
76/80 answers
Badges
19 169 262
Newest
 Nice Answer
Impact
~3.1m people reached

Oct
3
comment What are the security implications of phone based keyless entry systems?
What happens if the power goes out, or the wifi router crashes?
Oct
2
comment Does SQL have any inherant weaknesses?
i.qkme.me/3r5wug.jpg
Oct
2
comment Digital Signature and Verification?
@Ninefingers That's fair - it's why I qualified it as "can be", but I should've been clearer.
Oct
1
comment Effective wireless scanning to meet PCI DSS 11.1?
Have you considered a cantenna? They're great for directional scanning. If you use a really crappy WiFi dongle, you can use it for 802.11 bug scanning, since it'll only pick up the signal if you're nearby and roughly facing it. Grab a tube of Pringles and give it a go.
Oct
1
comment How can I identify my phone call is being tracked or tapped?
Yeah, even places with terrible telephone infrastructure (e.g. India) are mainly using switched stuff these days. Then again, in such places you'd never be able to check for clicks and pops, because the line is so terrible you'd get them anyway!
Oct
1
comment How can I identify my phone call is being tracked or tapped?
Yeah, the old click/pop detection only works on ancient telephone exchanges built in the '50s and '60s, or taps on the incoming line. This was because they literally tapped the line, often with something as low-tech as crocodile clips. These days everything gets digitised and translated onto packet-switched networks at the local exchange, so the TSPs can just save it to a file. Heck, you could capture and extract the conversation with something as simple as Wireshark and a python script.
Oct
1
comment What is disk encryption worth? Threat of proprietary Bios, SMM, optionrom, TPM etc?
@humanityANDpeace A BIOS is a microcontroller, so it can indeed be exploited via code execution vulnerabilities. However, these issues are very rare and always require the attacker to have kernel-mode code execution privileges on the machine. At that point, your risk model doesn't matter, because they've already compromised the box entirely. The network card one that you mentioned before attacked the firmware of a network card, and not the system BIOS, allowing the attacker to steal network frames, but not access the system.
Oct
1
comment User data encryption/decryption in a database (PHP)
@lspuk Crypto is hard - don't roll your own. Take a look at The Definitive Guide to Forms-Based Website Authentication, How to securely hash password, how to store salt and do any experts recommend bcrypt?.
Oct
1
comment What is disk encryption worth? Threat of proprietary Bios, SMM, optionrom, TPM etc?
@humanityANDpeace Note that modern boards have DualBIOS, which means that even if you found a way to alter the signature checking code on the primary BIOS chip, the secondary BIOS chip will recognise the integrity failure (a checksum is exchanged at boot) and restore the original image. It's exceedingly difficult to break the integrity of a modern BIOS.
Oct
1
comment What is disk encryption worth? Threat of proprietary Bios, SMM, optionrom, TPM etc?
@humanityANDpeace The BIOS standard requires them to implement a checksum that allows only authorised vendor code to be flashed to it. This is usually implemented by a custom hash function in the chip's inbuilt ROM, which cannot be altered. It's possible to de-cap a BIOS chip and use an electron microscope to reverse engineer the algorithm and key constant, but the equipment is expensive and the expertise required is uncommon. The more modern chips use public key cryptography to authenticate the update payloads, so even decapping is useless.
Oct
1
comment What is disk encryption worth? Threat of proprietary Bios, SMM, optionrom, TPM etc?
@humanityANDpeace I have some experience with hardware tampering and reverse engineering, and can tell you that desoldering modern chips is a nightmare if it's anything but a DIP or SOIC case, especially on multi-layer boards. I have to get my SOIC desoldering done professionally, with expensive desoldering equipment. BIOS chips are usually TQFP cases, and TPMs are often BGA, which are almost impossible to desolder without destroying the pads or board, even with the proper equipment in a lab.
Oct
1
comment How to test for SQL injection query
+1 for the image, I'd completely forgotten about that one. Priceless! :D
Oct
1
comment Advice on selecting programming languages to concentrate on? (2nd year IT security student)
As a side note - for general advice like this, come join us in chat.
Oct
1
comment Advice on selecting programming languages to concentrate on? (2nd year IT security student)
StackExchange has a strict set of guidelines as to what kind of questions are allowed here - only questions with definitive and objective answers are accepted. Unfortunately, your question is too localised and will be unlikely to help future users. Furthermore, the answer is subjective - it entirely depends on your country, circumstances, personal preferences, etc. As such, this question will likely be closed. For more information, please see the FAQ.
Sep
30
comment Can a webcam be turned on when disabled in Windows' device manager?
Assuming it's an external one, at that point it'd be quicker to physically remove the webcam. Obviously with a laptop you don't have that option.
Sep
28
comment SSL decryption in Wireshark
@Bruno Yeah, that's true. I was attempting to explain it in layman's terms, so I didn't include the details. Either way, the private key directly or indirectly provides confidentiality of the session key, which provides confidentiality of the underlying data stream.
Sep
28
comment How do AV vendors choose malware names?
Note that the family name is usually taken, as Rory said, from strings found within the malware binary. If there's a lack of good ones, they make a name up.
Sep
28
comment SSL decryption in Wireshark
@cprogcr The private key of the certificate is used to encrypt the handshake, which contains the session key exchange. You need the private key to decrypt the handshake, which you can then use to decrypt the traffic.
Sep
28
comment How can I scan open ports without being traced back
@Rook But in that case you may leave logs on the FTP box.
Sep
26
comment What is the purpose of using Youtube-style alphanumeric ids as URL slugs?
@Iain My apologies, I missed the word "hacking" in reason #2. I guess it is a security question, then.