12,036 reputation
11651
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 2 years, 7 months
seen 7 hours ago

Canadian insurance company Security Manager.

Owner of: SelfPhish.com


Jan
28
comment Suppressing broadcast traffic in honeyd logs?
Filter packets at firewall?
Jan
27
comment Regulations that specify password length?
@MarkC.Wallace I agree that 'regulations' is a broad scope, but I'm not looking for applicability, merely an example of a regulation that makes a positive statement on password lengths.
Jan
22
comment Bank accepts different password to the one that I set
Not only that, but you hope you have enough complexity in those first few characters. "password1q@W" is nice and complex. "password" will be tried first in brute force ... If they only use 8 chars, then they need to communicate that to users to enable them to compensate.
Jan
21
comment How to find malicious images in server?
Images or html tags to images? Look through your web data to find img tags with CSRF code.
Jan
21
comment Basic Security Knowledge
These are all very good questions to ask, but you haven't asked them in a way that will help us answer you.
Jan
14
comment Security against IP Spoofing
@user2320464 Sure, but if the attacker can successfully perform an IP spoof, then they can edit a cookie to match
Jan
14
comment Security against IP Spoofing
@user1369975 the endpoint cannot do anything about a spoofed IP. The TCP/IP stack just wasn't designed for that level of integrity checking.
Jan
14
comment Security against IP Spoofing
@Anonymous I'm not upset. I'm correcting you while giving you a chance to fill-in any knowledge gaps that I might have. Fast and loose security advice hurts us all.
Jan
14
comment Security against IP Spoofing
Cite your source for "IP address spoofing is quite common in many attacks..." Have you personally used loose source routing at any point? It is frequently blocked making it impossible to use as a reliable vector for attack.
Jan
13
comment Security against IP Spoofing
Also, why are you considering logging the source port of the attacker? Those will be randomly assigned anyway and of little value as a means to identify blockable targets.
Jan
13
comment Security against IP Spoofing
Why would an attacker reach your non-main ports first? Your system depends on someone reaching non-critical services before the critical ones. That's a highly specific scenario.
Jan
13
comment How to find the actual address of spoofed IPs?
On what basis are you 'convinced'?
Jan
6
comment How to check if computer is controlled remotely
en.wikipedia.org/wiki/Wake-on-LAN
Jan
6
comment How to check if computer is controlled remotely
Unless it is set to wake up to receive commands from a controller ...
Jan
4
comment How safe is backtrack to use?
@AviD agreed, but in this case, it isn't simply bugs, but behavior. Compromising Backtrack at the source is like trying to scratch the lens of a microscope and hoping that the technicians don't notice.
Jan
4
comment MiTM not working --rejected by router?
@user2945577 we can't help without a better description of the network configuration
Dec
31
comment MiTM not working --rejected by router?
If you aren't seeing traffic from your target in Wireshark, then you have a basic routing problem. It is possible that you are not on the target's local network. What we would need from you is a description of your network setup. What's in between your target and your attacker?
Dec
18
comment How can someone go off-web, and anonymise themselves after a life online?
@RoryAlsop define 'identify you'.
Dec
18
comment How can someone go off-web, and anonymise themselves after a life online?
Of course. The data exists. Are you expecting to reach into the the databases of the world to delete the information? The only way to anonymize is to deassociate yourself from those data sets. An efficient way to do that is to 'invalidate the index' by dereferencing yourself from the index, i.e. change your identity.
Dec
18
comment How can someone go off-web, and anonymise themselves after a life online?
Winess protection programs have a system for this. Change name, change national id numbers, change location, change vocation. All without linkages between the old and new.