10,013 reputation
11547
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 2 years, 4 months
seen 13 hours ago

Canadian insurance company Security Manager.


Mar
19
comment Wireless entry systems why not use pre-shared noise?
How is the 'noise' being generated? A pre-shared key needs to be complex enough to increase the effort to brute force.
Mar
19
comment TEMPEST std Air Gap. What realisation should I take for?
This question is all over the place. Tent/Cage/Enclosure are the same thing. Then you mention that you can't understand how a computer runs inside one of these. I think you have other questions you need to be asking.
Mar
19
comment What are the possible rules to identify password sharing- to prevent fraud
If the motivation to share exceeded the motivation not to share, then your scheme fails. How would you detect if sharing was happening in order to enforce policy? If it is a work account, then your last point won't work because the point is to share access and authority.
Mar
12
comment Internal / external Penetration testing a webserver - PCI
I didn't say that it has to be a professional penetration tester.
Mar
11
comment Internal / external Penetration testing a webserver - PCI
Need more info - are you storing CC info on a database at the hosting site? Is the hosting company specialized to deal with PCI compliance? Is it a shared or dedicated server?
Mar
11
comment Is there any way to restrict multiple access to my server at the same time using one client certificate?
This seems the most logical. If the login can only be successful if the cert matches the login, then you simply handle the authenticated sessions at the application level. Putting the control any further down the stack could result in @Gilles' issues in his comment above.
Mar
11
comment What if anything is the security differences between team viewer 7 and team viewer 9?
Increased passcode complexity addresses one of the issues. The plaintext communication between server-client is the other and I see no mention. It would need to be verified.
Mar
11
comment What causes a powershell payload to run the first time but not the second?
The code in that article is pretty rough. Perhaps it doesn't exit out of PS cleanly and hangs the process?
Mar
10
comment Exploiting through a filtered port
I assume 192.168.2.2 is the TARGET_IP?
Mar
10
comment Protecting against/detecting a specific Man in the Middle attack
Is the server the trusted authority for validating the keys? Clients could digitally sign their public key, if the CA is not the server you are suspecting. As long as the cert chain is properly configured, the server could not interfere without being noticed.
Mar
5
comment Can this code be expoited using Buffer Overflow?
@TimWilliams Perhaps you need to bold the lines that might make the successful exploit clear.
Mar
5
comment What is wrong with a confirmation page displaying my password?
@Iszi Agreed. The problems of transmitting a password, in any form, in plain text has the obvious shoulder-surfing/interception issues that may or may not be an issue in the moment, but it indicates the potential for other problems with the development security model.
Mar
5
comment Automatic exploit searches
exploit-db's archive in csv form would also have what you need.
Mar
5
comment how are CVSS scores used in security risk management products?
@sashank CVSS scores are used "as input" to the organizational calculations. They are raw data scores without relevance. You don't extrapolate, you interpolate. By combining those scores with a relevance metric, such as the environmental score, you get an organizational score. crato gave you the answer you asked for.
Feb
26
comment NaCl: US Export Regulations
Comment or answer makes no difference. Bad advice all around. Encryption export controls are maintained by international agreements and are not US-specific.
Feb
25
comment “Keyset does not exist” when using SignData function with RSA
And I assume you used the ToXMLString function for those bare strings?
Feb
25
comment The overlapping fragment attack using Scapy
If you are hoping to craft a packet to pass through a firewall on port 80, but connect to a telnet server on the outside, why not just setup the telnet server on port 80?
Feb
25
comment The overlapping fragment attack using Scapy
Not sure that I can envision what you hope to do here. You want to overwrite data after it has passed through the firewall? If you change dest port numbers part way through a fragment, are you hoping to connect to the 'new' port number?
Feb
25
comment NaCl: US Export Regulations
No part of this answer is actionable.
Feb
25
comment Compliance with an industry recognized framework - ISO27k
Part of the answer deals with 'why'. Do you have a regulatory requirement for such an alignment? Did a manager hear about a framework and wants to see it implemented? Do you need to prove to partners or customers that you adhere to a framework? Does your organization want the benefits of employing a framework?