6,487 reputation
727
bio website lampe2e.blogspot.co.uk
location Scotland, United Kingdom
age
visits member for 4 years, 5 months
seen yesterday

Apr
24
awarded  web-application
Apr
2
awarded  Popular Question
Mar
30
revised follow up to previously answered “Escalating from Apache shell to root”
added link to reference source, removed redundant stuff
Mar
27
answered Tracking IP address to prevent abuse without logging user metadata
Mar
26
comment Anti-virus anonymity question
Do you really believe if you use a VPN, don't store cookies and send DNT headers you have privacy?
Mar
26
comment Anti-virus anonymity question
Since we're talking about anti-virus software, then really we're talking about the integration of the AV software with winsock.dll - the AV sits between winsock and the application client - hence has full visibility of the unencrypted datastream. It also has visilibility of hostname lookups.
Mar
24
comment Could an attacker prevent IIS from logging requests
...so you've identified a gap in your ability to detect an attempted attack (yay!)
Mar
17
answered Is there a risk in opening port 22 for ssh access with a network?
Mar
9
awarded  Popular Question
Feb
24
comment security reviews of third party code
Actually, there was a time when Microsoft made quite a big deal out of making their source code available to selected partners for very high licence costs and very strict NDAs - it was really all just theatre when you'd need to spend at least as much as Microsoft spent writing the code to audit it properly.
Feb
20
answered How safe is SSL on an untrusted computer and network?
Feb
19
answered Categories of security when evaluating services and protocols
Feb
14
revised PHP Plugin Security
typos
Feb
14
comment PHP Plugin Security
While I don't really want to encourage people to try this unless they know what they are doing....yes there are lots of ways to obfuscate and even encrypt code, but there are only a few ways to get php to execute code (popen, exec, et all, create_function, eval, include)
Feb
14
comment How to determine if someone is scanning my server?
One trick not mentioned here is to leave some well known ports open (or redirected) to a tcp wrappers handler - although this isn't going to help if you're running a webserver and the scanner is only targetting a single service which is already in use on the machine.
Feb
14
answered PHP Plugin Security
Feb
7
comment Can someone steal cookie contents via a phishing attack?
The attacker cannot capture cookies with the secure flag set unless the user accepts a forged certificate. If the real site is vulnerable to xss then the attacker probably doesn't need to bother with a rogue IP/fake website.
Jan
30
answered Website infected with unwanted “redirections”, apparently via javascript code
Jan
28
answered Usability of a found OTP Token for my own system
Jan
23
comment Why not generate a client SSL with expiration date in very distant future?
(I should also add that certificates may be compromised by other means than a direct attack on the cipher - i.e. the key might be stolen)