Reputation
1,363
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
6 12
Newest
 Yearling
Impact
~48k people reached

2d
comment Noob to tor/tails/darknet…forgot to disable Javascript. What to do now?
Staying "anonymous" on the internet. There's always something that will give you away. Once you've created a history, assume it's permanent. Your computer isn't the only place history is found.
Apr
30
comment How secure is it to use passwords consisting of one common part and one site specific prefix?
Heh, once the pattern is known, the password length is vastly reduced. Three letter passwords are really secure, eh?
Apr
29
comment I almost searched my password, but didn't press enter. Is my password at risk, because of autocomplete or anything else?
Your password shouldn't be something that autocomplete will complete (dictionary crackable), but change it any time it's been potentially exposed
Apr
29
comment Popular Security “Cargo Cults”
Some of the more popular open source out there has proven in the last couple years to have glaring security issues despite being open and having the possibility of lots of people scrutinizing it. Some of it has even had severe issues that we find have been there for a decade or more. Though there is the ability for it to get patched fairly immediately once the issue is found. ALL open and closed source software has issues and that fact will never go away.
Apr
25
comment Is exposing exception information in web service a security risk?
Google Dorks - Google cached stack trace/error dump pages containing anything from obtuse jargon to explicit access credentials. I've come across several that give away the keys to the kingdom. Writing this to a local file would have saved the embarrassment from that one error catch routine that someone forgot to sanitize.
Apr
23
comment What could a malicious website do if you don't update Adobe Flash?
Dun, duh, dah, dun.... Anything. Depends on what the Exploit Server sends you. From just barely annoying adware to a full system lockdown by ransomware.
Apr
22
comment Advertisement on Skype tried to download a file to my computer using Javascript
Sweet, malvertisement over Skype. A nice side effect of JavaScript everywhere. Even where it isn't needed.
Apr
22
comment Recent hack appends to all javascript files
Both Magento and WordPress are notorious for having serious vulnerabilities if not kept patched. The shoplift bug in Magento allowed easy database insertion of admin level users which then could be used to log into the downloader to install a php file manager like MagePleasure. Other WordPress vulnerabilities allow for direct shell and file access. Their plugins, depending on the developers security willpower and expertise can be vulnerability sieves.
Apr
17
comment My website is getting this request all day long every minute xmlrpc.php
Sounds line a scripted brute-force attack is being attempted against the xmlrpc API. The firewall is doing its job by blocking it. You can't really do anything about it except block it and wait till they go away. The ip mentioned is a Russian IP for offers4now.net
Apr
17
comment Why do hackers scan for open ports?
Rattling door knobs to see what's there (identify services through fingerprinting) and if a lock has been applied (has it been secured) or if the lock is busted (is the service vulnerable). Why? It's easily scriptable, takes little effort.
Apr
14
comment Clicking a lot of website links in Google Maps, then sent through multiple URL redirects, and lastly to a page that made my laptop start beeping?
Welcome to hijacked websites and redirects to malvertising and exploit servers. You clicked a link to a hacked website that randomly redirects. It delays discovery when they do this.
Apr
8
comment How much can I trust Tor?
I would trust it as much as any other government sponsored and government initiated software program.
Apr
6
comment End-to-end WhatsApp vs Telegram
End of discussion, already established here with the latest comments and posts that if you choose Telegram, you might deserve it => security.stackexchange.com/questions/49782/…
Apr
5
comment Cases where DBAN has won
You can detect the disk has been overwritten would apply to any case where law enforcement knew you were using disks and found an empty disk (no recoverable data) that wasn't still in the manufacturer's sealed antistatic. The final DBAN run should be a zero fill. Does DBAN time stamp the disk somehow after doing that?
Apr
5
comment Can a .sh file be malware?
Because it's so devastating, in later versions of the shell, there is built in protection (preserve root) against blindly executing rm -rf / which is a totally excellent way of clearing massive amounts of disk space... :0
Apr
5
comment JavaScript eval() to parse JSON after sanitizing with regexes — is XSS possible?
Good to make sure you don't fall afoul of Schneier's law in other venues. Always remember that self-reference as to impossibilities of compromise are a bad indicator for elephant detection.
Mar
27
comment How do RATs access computers through routers?
RATS call home. You have to block their outbound traffic somehow, often by removing them.
Mar
27
comment Internet of things is what exactly?
@AndréBorie - Yes, it's serious enough that iOS needs to be taken away from Apple and IoS repurposed for its true definition as I don't think the situation will go away any time soon. Profits and human nature get in the way. Also, AI will be good for humankind if Tay is any indicator. The earth will finally know peace when AI reaches the ultimate "Final Solution".
Mar
26
comment Internet of things is what exactly?
Well, therein lies the issue. What are you doing with the Raspberry Pi, BeagleBone, Arduino or any other number of internet connected microprocessor systems? It ranges from highly complex industrial grade with security to bone dead simple. And so the whole thing is quite nebulous as a definition at this point. Is a internet controllable power strip an IoT device based on whether it's an http server controlled, password protected microprocessor device or a mini-computer controlled device that can use SSH/HTTPS and accepts certificates for authentication, authentication, audited access control?
Mar
26
comment If someone hacks my wi-fi password, what can they see and how?
They would see the same thing that they would see if they snuck into your house and plugged their laptop into your ethernet hub with an ethernet cable. And could either sniff traffic or directly connect to any computer on your network allowing them to do anything they wanted.