Reputation
1,363
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
6 12
Newest
 Yearling
Impact
~48k people reached

1d
comment Noob to tor/tails/darknet…forgot to disable Javascript. What to do now?
Staying "anonymous" on the internet. There's always something that will give you away. Once you've created a history, assume it's permanent. Your computer isn't the only place history is found.
1d
revised Can they tell which individual computer was torrenting on shared internet connection?
add service name
1d
answered Can they tell which individual computer was torrenting on shared internet connection?
1d
comment How secure is it to use passwords consisting of one common part and one site specific prefix?
Heh, once the pattern is known, the password length is vastly reduced. Three letter passwords are really secure, eh?
Apr
29
comment I almost searched my password, but didn't press enter. Is my password at risk, because of autocomplete or anything else?
Your password shouldn't be something that autocomplete will complete (dictionary crackable), but change it any time it's been potentially exposed
Apr
29
comment Popular Security “Cargo Cults”
Some of the more popular open source out there has proven in the last couple years to have glaring security issues despite being open and having the possibility of lots of people scrutinizing it. Some of it has even had severe issues that we find have been there for a decade or more. Though there is the ability for it to get patched fairly immediately once the issue is found. ALL open and closed source software has issues and that fact will never go away.
Apr
25
comment Is exposing exception information in web service a security risk?
Google Dorks - Google cached stack trace/error dump pages containing anything from obtuse jargon to explicit access credentials. I've come across several that give away the keys to the kingdom. Writing this to a local file would have saved the embarrassment from that one error catch routine that someone forgot to sanitize.
Apr
23
comment What could a malicious website do if you don't update Adobe Flash?
Dun, duh, dah, dun.... Anything. Depends on what the Exploit Server sends you. From just barely annoying adware to a full system lockdown by ransomware.
Apr
22
comment Advertisement on Skype tried to download a file to my computer using Javascript
Sweet, malvertisement over Skype. A nice side effect of JavaScript everywhere. Even where it isn't needed.
Apr
22
comment Recent hack appends to all javascript files
Both Magento and WordPress are notorious for having serious vulnerabilities if not kept patched. The shoplift bug in Magento allowed easy database insertion of admin level users which then could be used to log into the downloader to install a php file manager like MagePleasure. Other WordPress vulnerabilities allow for direct shell and file access. Their plugins, depending on the developers security willpower and expertise can be vulnerability sieves.
Apr
17
comment My website is getting this request all day long every minute xmlrpc.php
Sounds line a scripted brute-force attack is being attempted against the xmlrpc API. The firewall is doing its job by blocking it. You can't really do anything about it except block it and wait till they go away. The ip mentioned is a Russian IP for offers4now.net
Apr
17
comment Why do hackers scan for open ports?
Rattling door knobs to see what's there (identify services through fingerprinting) and if a lock has been applied (has it been secured) or if the lock is busted (is the service vulnerable). Why? It's easily scriptable, takes little effort.
Apr
14
comment Clicking a lot of website links in Google Maps, then sent through multiple URL redirects, and lastly to a page that made my laptop start beeping?
Welcome to hijacked websites and redirects to malvertising and exploit servers. You clicked a link to a hacked website that randomly redirects. It delays discovery when they do this.
Apr
8
comment How much can I trust Tor?
I would trust it as much as any other government sponsored and government initiated software program.
Apr
6
comment End-to-end WhatsApp vs Telegram
End of discussion, already established here with the latest comments and posts that if you choose Telegram, you might deserve it => security.stackexchange.com/questions/49782/…
Apr
5
comment Cases where DBAN has won
You can detect the disk has been overwritten would apply to any case where law enforcement knew you were using disks and found an empty disk (no recoverable data) that wasn't still in the manufacturer's sealed antistatic. The final DBAN run should be a zero fill. Does DBAN time stamp the disk somehow after doing that?
Apr
5
comment Can a .sh file be malware?
Because it's so devastating, in later versions of the shell, there is built in protection (preserve root) against blindly executing rm -rf / which is a totally excellent way of clearing massive amounts of disk space... :0
Apr
5
comment JavaScript eval() to parse JSON after sanitizing with regexes — is XSS possible?
Good to make sure you don't fall afoul of Schneier's law in other venues. Always remember that self-reference as to impossibilities of compromise are a bad indicator for elephant detection.
Apr
2
answered What are the security risks of importing and processing an excel spreadsheet from an untrusted user
Mar
27
comment How do RATs access computers through routers?
RATS call home. You have to block their outbound traffic somehow, often by removing them.