1,028 reputation
412
bio website
location
age
visits member for 3 years, 7 months
seen 5 hours ago

Been on the Internet since before there was an Internet. Remember UUCP, news feeds, and Gopher?


Mar
28
awarded  Necromancer
Mar
1
comment Vega Scanner Took Website offline?
You used a security vulnerability scan tool to scrape social data? Be aware that anyone paying attention to the logs will start serving you a permanent 403.
Feb
26
comment Can anyone predict the scope of security in the year 2030?
Well, we hope it gets better? Given the advancing complexity of OS/program interaction, we know an enormous amount about what doesn't work, but everytime somebody announces they've got a handle on providing secure environments, yet another genius finds a new way to attack that sidesteps a lot of assumptions. IOW, no answer for something that's 15 years away. We already know the IOT is severely broken, with growth and watching the bottom line on expense by people who're creating the tech, the door's wide open.
Feb
22
comment Similarly to How Photos Have Meta Data, Does Audio As Well?
MP3 files are tagged with meta data.
Feb
20
comment Tamper proof hardware - not resistant
Old engineer's rule, "It is impossible to make anything foolproof because fools are so ingenious." Or to put it another way stated by a former boss, "I find his incompetence truly amazing, he's the only person I've ever seen break a ball bearing with a broomstick."
Feb
20
comment Why was the private key of the Superfish certificate so easily extractable?
@ceejayoz - In a country that small with as many threats as they have to face, they don't have the luxury of running a volunteer army. BTW, the password to access the private cert is komodia. Expect exploits soon. Anything that uses Komodia software is vulnerable to the attack (Qustodio, Keep my Child Secure, etc.)
Feb
20
comment Why was the private key of the Superfish certificate so easily extractable?
As a side note, the source for the SuperFish software is Komodia, a company formed by a former Israeli IDF Intelligence Core programmer. Who at the moment is claiming they are under attack per Forbes Magazine.
Feb
20
comment Why was the private key of the Superfish certificate so easily extractable?
Embedded as a string, hmm, so doing a strings search on the binaries would show it? I think the key was taped to the front of the safe in plain sight then.
Feb
19
comment Can serving HTTPS to Internet Explorer on Windows XP be made secure?
Call your local mortuary and look into the cost of cremation vs. burial, Windows XP is dead on the security front. As with IE 4 backwards compatibility back in the day, web developers across the board ceasing to support old, dead browser combinations is the quickest way of moving users into more secure environments. We didn't need to keep fluent in browser display hacks then, we shouldn't be accommodating browser/OS combinations that leave our customers vulnerable now.
Feb
17
comment Firmware Backdoor Protection
As a continuation of the threats given by firmware of all sorts, be prepared for all hard drives to be totally untrustworthy. The Equation Group hard drive firmware APT renders drive wiping to be easily applied soul salve that does nothing. Waiting for when it becomes a general production for all other malware. Rootkits will be a thing of the past, rooted firmware rules.
Feb
16
comment Why is it so hard to trace origins of DDOS attacks?
The key word is Distributed Denial of Service.
Feb
14
comment “Yea, I can hear them” I just heard this from my computer speakers
Remote access trojan...
Feb
11
comment What level of anonymity can I expect while using a library's user session?
Freedom of the press belongs to them what owns their own press.
Feb
8
comment Default Encryption - A Panacea or Placebo
Default encryption will shift the attack points. We already see that in action.
Feb
8
comment Why use one URL for all “pages” on my site?
What is the "logic" behind C and breaking the http status codes the web server sends out?
Feb
4
comment find if 0-day flash bug was exploited (on a particular machine)
Allowing User Level compromise is pretty late in the game and an underestimation. You don't have to catch a rootkit to be owned at the user level and to have leaked everything. Google applications that install in userland are a pretty good demonstration that a lot less than nothing gets installed ;^).
Jan
20
awarded  Nice Answer
Jan
20
revised An attacker has my IP address;So what?
added paragraph that explains response as answer to question.
Jan
20
answered An attacker has my IP address;So what?
Jan
18
comment Can a malicious Tor exit node perform a HTTPS man-in-the-middle attack to see/modify your HTTPS traffic?
@SteffenUllrich - Pretty much the grain of truth at the heart of it, as long as humans have to interact with encryption, there's always an end run around it.