1,228 reputation
511
bio website levii.com
location
age
visits member for 3 years, 7 months
seen Jul 14 at 21:46

Jul
14
comment Monitoring file access on Windows
Akauppi - thanks; I've changed the link to reference a Wayback Machine archived copy so that shouldn't happen again.
Nov
2
comment Practices for storing username/password in Web applications
Have you looked at the answers here: security.stackexchange.com/questions/22817/… ?
Oct
25
comment How to encrypt database connection credentials on a web server?
While there are a number of options the easiest under Ubuntu is probably to use EFS to encrypt the user's home folder that is running your process. An after the fact method is here: howtogeek.com/116032/… but it's certainly not the only option.
Oct
19
comment Safety of opening .txt files via URL
This is a good answer and is a typical audit test. Load a simple script tag into a text document with an alert, load it to your host and open it via the browser. Since the type is text/html, in many browsers the JS will execute and may be malicious in nature. (That said, the mime type could be anything, but this is an example of why one has to be careful of how they redisplay uploaded files).
Oct
19
comment Sharing of Wireless Security and Encryption Settings
I should have put that in an answer instead of a comment :\
Oct
19
comment How to encrypt database connection credentials on a web server?
If you're going to downvote, provide commentary please.
Oct
19
comment Changing windows client form values at runtime
Thanks for DDE - it was the perfect attack channel proof. Though we were using Oracle Advanced Security and user entered credentials, so I couldn't tamper with anything once on the wire, the ability to demonstrate that attack and why the client itself was vulnerable was useful. We couldn't get rid of the VB6 application, but we did change the architecture so that communications take place to a WCF service that validates credentials, user accesses, values passed, etc.
Oct
19
comment Sharing of Wireless Security and Encryption Settings
@Henning: Non broadcasting SSIDs won't show.
Oct
19
comment How to encrypt database connection credentials on a web server?
This assumes that the database is running on the same system as the web server itself - this is not a good idea and DISA/NIST specifically reccomend against it. Still having the configuration files in a non-world readable location is key.
Oct
1
comment Digital Signature and Verification?
Correct. The private key is always used for the sensitive part of the operation (encrypting a message hash for signing, or decrypting a message intended for a specific person)
Sep
28
comment PCI-DSS compliance for business with only swipe terminals
Move your swipe terminals to a separate network (can be logically segmented) compliance at that point since you're on a single purpose system/single purpose network with a PCI L1 provider doing the processing should make you eligible for the shortened self-assessment: pcisecuritystandards.org/documents/pci_saq_a_v2.doc it's the place to look anyway (the site/docs)
Sep
27
comment How can I scan open ports without being traced back
Use proxychains or anything else similar to tunnel your traffic across the established tor connection: examples -- commondork.com/2009/06/26/tunneling-nmap-through-tor -- aldeid.com/wiki/Tor/Usage/Nmap-scan-through-tor
Sep
27
comment HTML 5 postMessage PCI compliant
You may want to check the source property as well: developer.mozilla.org/en-US/docs/DOM/window.postMessage ... I'd also ensure that an application firewall is in place to monitor and filter these requests.
Sep
21
comment What defines a programming language as useful for hacking?
I can't tell you how much I hate debugging PERL though ... at least the Eclipse PERL debugger is pretty good :) It is good for knocking something out quick - but like LISP; it just hurts my brain.
Sep
21
comment What defines a programming language as useful for hacking?
+1 since largely the capability for re-use of existing frameworks is the single largest benefit. I can certainly write apps to pen-test in any language, but not-having to reinvent the wheel (and not having to compile) gives directly executed languages a bit of a benefit
Sep
21
comment Why is php not used for banking sites or for a banking transaction?
Java and SQL server, or C# and Oracle are used often. The database is (or at least should be) irrelevant to the development language.
Nov
22
comment Best efficient windows hardening audit script
Well, I can't think of anything solid out there other than MBSA for the moment, but it does look like MSFT and NIST are teaming up with some SCAP/OVAL cmdlets for powershell scap.nist.gov/events/2011/itsac/presentations/day2/… , services.nvd.nist.gov/jira/browse/SCAPDEV-1
Nov
21
comment Best efficient windows hardening audit script
Is there any reason you can't use a third party set of tools? SCAP (security content automation protocol) is designed specifically to do this with various policies and benchmarks.
Aug
29
comment Password entropy in layman's terms
Obligatory xkcd.com/936
Aug
29
comment The Creation of Secure Software Development Environments
@Rory & DW. Thank you for the follow ups - and I agree with both of you in that isolation is one of a myriad of protections that needs to be in place. My shortcoming is in finding reference guidance and frameworks for this type of isolation. I'd assumed that I'd need to build much of the framework myself and the issue is finding whitepapers or industry research to support it.