10,023 reputation
11547
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 2 years, 4 months
seen 3 hours ago

Canadian insurance company Security Manager.


Mar
10
comment Exploiting through a filtered port
I assume 192.168.2.2 is the TARGET_IP?
Mar
10
comment Protecting against/detecting a specific Man in the Middle attack
Is the server the trusted authority for validating the keys? Clients could digitally sign their public key, if the CA is not the server you are suspecting. As long as the cert chain is properly configured, the server could not interfere without being noticed.
Mar
5
comment Can this code be expoited using Buffer Overflow?
@TimWilliams Perhaps you need to bold the lines that might make the successful exploit clear.
Mar
5
comment What is wrong with a confirmation page displaying my password?
@Iszi Agreed. The problems of transmitting a password, in any form, in plain text has the obvious shoulder-surfing/interception issues that may or may not be an issue in the moment, but it indicates the potential for other problems with the development security model.
Mar
5
comment Automatic exploit searches
exploit-db's archive in csv form would also have what you need.
Mar
5
comment how are CVSS scores used in security risk management products?
@sashank CVSS scores are used "as input" to the organizational calculations. They are raw data scores without relevance. You don't extrapolate, you interpolate. By combining those scores with a relevance metric, such as the environmental score, you get an organizational score. crato gave you the answer you asked for.
Feb
26
comment NaCl: US Export Regulations
Comment or answer makes no difference. Bad advice all around. Encryption export controls are maintained by international agreements and are not US-specific.
Feb
25
comment “Keyset does not exist” when using SignData function with RSA
And I assume you used the ToXMLString function for those bare strings?
Feb
25
comment The overlapping fragment attack using Scapy
If you are hoping to craft a packet to pass through a firewall on port 80, but connect to a telnet server on the outside, why not just setup the telnet server on port 80?
Feb
25
comment The overlapping fragment attack using Scapy
Not sure that I can envision what you hope to do here. You want to overwrite data after it has passed through the firewall? If you change dest port numbers part way through a fragment, are you hoping to connect to the 'new' port number?
Feb
25
comment NaCl: US Export Regulations
No part of this answer is actionable.
Feb
25
comment Compliance with an industry recognized framework - ISO27k
Part of the answer deals with 'why'. Do you have a regulatory requirement for such an alignment? Did a manager hear about a framework and wants to see it implemented? Do you need to prove to partners or customers that you adhere to a framework? Does your organization want the benefits of employing a framework?
Feb
19
comment How can it be possible to have encrypted communication between a server and a client if the server has only a public key
look at SSL/TLS .... Is this a homework question?
Feb
13
comment manually approach to check vulnerabilities?
"We are not supposed to use..." Is this a homework assignment?
Jan
28
comment Suppressing broadcast traffic in honeyd logs?
Filter packets at firewall?
Jan
27
comment Regulations that specify password length?
@MarkC.Wallace I agree that 'regulations' is a broad scope, but I'm not looking for applicability, merely an example of a regulation that makes a positive statement on password lengths.
Jan
22
comment Bank accepts different password to the one that I set
Not only that, but you hope you have enough complexity in those first few characters. "password1q@W" is nice and complex. "password" will be tried first in brute force ... If they only use 8 chars, then they need to communicate that to users to enable them to compensate.
Jan
21
comment How to find malicious images in server?
Images or html tags to images? Look through your web data to find img tags with CSRF code.
Jan
21
comment Basic Security Knowledge
These are all very good questions to ask, but you haven't asked them in a way that will help us answer you.
Jan
14
comment Security against IP Spoofing
@user2320464 Sure, but if the attacker can successfully perform an IP spoof, then they can edit a cookie to match