32,303 reputation
347118
bio website bishopfox.com
location
age
visits member for 4 years, 4 months
seen May 19 at 20:26

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Dec
21
awarded  Good Question
Dec
21
awarded  Notable Question
Dec
21
revised Preventing user supplied javascript from posting to external server
deleted 3 characters in body
Dec
21
answered Preventing user supplied javascript from posting to external server
Dec
19
comment Reversible, recoverable user data encryption scheme
@KeithS With CBC mode, you must worry about decryption oracles and padding oracles. As far as I can tell your design does not take these attacks into consideration. As a penetration tester I eat developers for a living, as a cryptographer I can tell you you are out of your depth. Redesign this system using an authenticated mode. Then post smaller, well documented components to security.se for review.
Dec
19
comment Reversible, recoverable user data encryption scheme
@KeithS You expect feedback on your design, yet you leave out critical components. For instance make no mention of what mode of operation you are using with AES. Are you aware of the authenticated modes for block ciphers? Have you ever heard of a cryptographic oracle? Why do you think you can do better than the existing solutions that the rest of the world uses every day? Cryptography isn't some magic wand.
Dec
19
revised Reversible, recoverable user data encryption scheme
added 114 characters in body
Dec
19
comment Reversible, recoverable user data encryption scheme
@KeithS Just about everyone on security.se will go ape shit if you suggest replacing SSL with a home-brew system. I am one of these people. From experience I think that reinventing the wheel is one of the worst evils in the security industry. This discussion is not building a secure system, it is a learning experience for you and a waste of everyone Else's time.
Dec
19
answered At what point is password complexity “safe enough”
Dec
19
revised Reversible, recoverable user data encryption scheme
added 80 characters in body
Dec
19
comment Reversible, recoverable user data encryption scheme
@KeithS None of these problems are new, proven solutions already exist in the open source world. I like SSL a lot, their cipher suite system incorporates variants of all the proven primates such that when a vulnerability is found you can easily fall back on a secure set of primitives. NO SSL cipher suite is redundant, such as using bcrypt and sha256 at the same time. This is the opposite of your system, in that you are increasing the attack surface by increasing the complexity. If a flaw is found in bcrypt you have a problem, when a flaw is found in sha2 you also have a problem.
Dec
19
comment Changing user account passwords from PHP script - vulnerabilities?
@Ryan Griggs I expect some level of security in an application. Just about everything in your code is vulnerable as if you do not know the basics. strcpy() really? Do you know what a buff overflow is? Calling the commandline with attack supplied input? You should start from the beginning with a simple question instead of piling it on.
Dec
19
revised Reversible, recoverable user data encryption scheme
added 14 characters in body
Dec
19
revised Reversible, recoverable user data encryption scheme
added 523 characters in body
Dec
19
revised Reversible, recoverable user data encryption scheme
added 523 characters in body
Dec
19
revised Reversible, recoverable user data encryption scheme
added 523 characters in body
Dec
19
answered Reversible, recoverable user data encryption scheme
Dec
18
comment Changing user account passwords from PHP script - vulnerabilities?
Yes this is very obviously remote code execution. Worse idea ever. Voting to close.
Dec
18
comment Resource consumption attacks against algorithms
@bonsaiviking This is a great answer. I am looking for other vulnerable algorithms, and he found a whole set!
Dec
15
revised Resource consumption attacks against algorithms
edited title