12,181 reputation
745110
bio website security.stackexchange.com
location Florida
age 32
visits member for 3 years, 10 months
seen 5 mins ago

I'm not the droid you're looking for.


7h
comment Is it possible to modify the last time a user logged into Windows?
@Thebluefish True. Digital signatures are just another roadblock, here but they can be bypassed. Now, what's really tricky to get around is a system that's sending a live stream (or fairly frequent export) of its event logs to an aggregator. Then you've got two systems to worry about compromising and cleaning up after yourself on.
7h
comment Is it possible to modify the last time a user logged into Windows?
Assuming it's possible to gain privileges to arbitrarily write to the Event Log, and there's no particularly unique digital signature applied or checked for on it, (both of which I'm pretty sure are the case) I don't see why not. However, there are likely a lot of other artifacts you'd have to mess with to render this change undetectable by an educated investigator.
17h
comment Configuration file with 12-character XML-encoded passwords
@Dillinur Unfortunately, that is not an option. If these "hashes" can be easily broken, or do represent cleartext passwords, I would not want to have them on a public forum.
1d
revised Is storing CVV compliant with PCI standards?
Trying not to name names, and combine everything into a single coherent question.
1d
reviewed Close My site is being redirected to an app site when anyone tries to access site from an ipad
1d
revised Configuration file with 12-character XML-encoded passwords
deleted 4 characters in body
1d
asked Configuration file with 12-character XML-encoded passwords
2d
comment What is the best exploit of XSS within 100 characters?
Not a good question here, for various reasons. However, with a bit of re-scoping and clarification, it might be of interest over at Programming Puzzles & Code Golf. Narrow it down to "what is the most critical compromise possible" (according to some defined scale) and it might be good here.
Nov
12
comment Is Google's password recovery by entering an old password a bad practice?
2FA is a good recommendation, but does not at all address the question asked here.
Oct
28
reviewed Close What happens behind the screens during an HTTPS connection?
Oct
28
reviewed Close Home PC has been compromised remotely and even after cleaning my PC repeatedly, the problem still comes back, help please?
Oct
25
awarded  Necromancer
Oct
25
comment What can my university see if they have my MAC address?
@Will I'd hardly call it extremely stupid. Certainly, MAC spoofing is a possible issue and that same threat even exists against the MAC filtering. But, unless the school wants to set up more advanced authentication mechanisms for their network, it's often the only device identifier they can rely on to identify owners in cases of abuse. It's not fool-proof, but it's better than nothing - and in most cases, it's likely to be accurate.
Oct
24
awarded  Nice Answer
Oct
24
comment What can my university see if they have my MAC address?
@JamesC In the first case, network administrators have configured infrastructure devices to only permit access to approved devices, and the filtering is done by MAC address. In the second case, the infrastructure is not configured to block any devices but network admins do monitor for unrecognized devices.
Oct
24
comment What can my university see if they have my MAC address?
Perhaps a bit more definition is in order to describe "directly connected". One might translate this to mean "by a single cable between one device and another". However, MAC addresses are visible across the entire Layer 2 network - i.e.: everything connected to the same switch.
Oct
24
answered What can my university see if they have my MAC address?
Oct
23
reviewed Close how to embed exe file to pdf?
Oct
23
reviewed Close Is Firefox Password Manager less secure than LastPass?
Oct
16
awarded  Popular Question