Reputation
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
6 12
Newest
 Yearling
Impact
~44k people reached

Sep
5
comment How long does it typically take to distribute malware signatures?
More important nowdays is how accurate their heuristics engines are at noting past behaviors, unwanted and malicious behaviors, and matching up against variants to block activity before a signature is available. Signature only based malware detection is dead. You can custom order malware, each instance sold is recompiled to break signatures. There is no period of time at which you are ever safe. Exposure across the malware spectrum is continuous.
Sep
5
comment Can source javascript files be infected from a developer's machine?
Yes, developers are prime targets and this is an awesome injection point to exploit. Compare against old version copies. If you're not doing source control, or even simply keeping old backup copies as control copies to diff against, you're doing it wrong.
Aug
19
comment What is one way to verify emails of compromised website if registrations are not validated?
dating services to married men sb people in relationships looking for other relationships if you've ever been bombarded by their ads.
Aug
19
comment How to block detour programs that bypass firewalls?
And if you successfully ban zenmate, there's always another waiting in the wings.
Aug
15
comment Is using my phone number as a pin for a phone a security risk?
If it's known data about you, it isn't a password or pin. Just that simple. It's why all those secondary security questions are suspect. If it can be found on your facebook page or is known by your friends, business contacts, etc. it isn't secret. These are the first things somebody skilled in "social engineering" will try.
Aug
15
comment How safe are data you dial to a call center?
@OlegMazurov - old office trick, if the DTMF can be heard during dialing, the phone number is not a secret. Same goes for any PinPad you come across that has DTMF feedback. If it's not a simple bip to tell you the key has been pressed, it's data exfiltration.
Aug
14
comment Is a server which FTP credentials were kept in a machine with Firefox being used compromised after the latest firefox vulnerability?
In SSH, the public key resides on the server. You distribute the private keys to each person who will be accessing that server. They are stored in authorized_keys. A technical detail maybe, but somebody stealing this key can access your server SSH account, if you generated it without a passphrase or a weak one, bad dog, they have access now that they have the key.
Aug
13
revised Is a server which FTP credentials were kept in a machine with Firefox being used compromised after the latest firefox vulnerability?
add clarification on .ppk being text
Aug
13
comment Is a server which FTP credentials were kept in a machine with Firefox being used compromised after the latest firefox vulnerability?
@freedom Harsh fact, the transmission is secure, the storage isn't. Open a .ppk file in notepad, on Linux, open authorized_keys and authorized_keys2 in nano. Guess what I was doing this weekend, long before the question was asked?
Aug
12
revised Is a server which FTP credentials were kept in a machine with Firefox being used compromised after the latest firefox vulnerability?
added 209 characters in body
Aug
12
comment Is a server which FTP credentials were kept in a machine with Firefox being used compromised after the latest firefox vulnerability?
Good, secure transport cures a lot of ills. The vulnerability had free rein to read or write files so any computer running Firefox could have been compromised during the period it was run unpatched with only a possible message warning that the js pdf reader might not display correctly and to open in an external reader. And then depending on their target, Ukrainian cyberwar against Russia, Ukrainian separatist cyberwarefare against Ukrain or Ukrainian Cybercriminals? We don't know yet whose servers were being targetted at first, but I'd presume everyone now as it's escaped.
Aug
12
answered Is a server which FTP credentials were kept in a machine with Firefox being used compromised after the latest firefox vulnerability?
Aug
9
comment Ransom attacks - can I protect myself by encrypting all my files?
They'll just reencrypt your encrypted files...
Aug
7
comment Why do phishing emails have spelling and grammar mistakes?
Cybercriminals don't necessarily have a good education, or speak the primary language of the email as a second language on the generic garbage spam. Most of the quality phishing email out there doesn't have these issues and is often indistinguishable at first glance from whatever corporation is being spoofed. Targeted spearfishes will be by people who have studied internal documents and communications flow and will attempt to closely emulate the education level of the person they wish the email to appear from, including the types of mistakes they would make.
Aug
2
comment Stalking and harassment
Proof or else its paranoia. Belief isn't enough.
Aug
2
answered Can the Belkin WeMo switch be attacked without the attacker knowing my WiFi password?
Jul
25
comment Is it safe to use my personal password as my password in work related accounts?
No, it isn't. Single point of failure. One ring to rule them all and all that. The first assumption in hacking is that the mark is doing exactly that, using the same password everywhere.
Jul
24
comment Why does SQL not escape/sanitize by default?
SQL needs to store stuff sent to it without corrupting it. Use prepared statements and the issue becomes moot.
Jul
23
comment How dangerous is checking email on open Wi-Fi network
You are using an email service that transmits email using TLS encryption whether its imap, smtp, pop or https, correct? If not, then, yes.
Jul
21
awarded  Caucus