dguido

52 ms·

481.
by dguido 16y ago
Well, really we pay CAs for authentication, not encryption. Your computer can encrypt just fine on its own. Most of the solutions I've seen to this problem are done in one of three ways: 1. Create better tools to monitor for abuses, ie. Goo
482.
by dguido 16y ago
New York City, Seattle, and San Francisco - iSEC Partners - Application Security Consultants iSEC Partners is currently looking for Security Researchers and security-focused software developers to fill openings in its application security c
483.
by dguido 16y ago
Hate to break it to you but that actually means something. The technical details are surprisingly on target for being written by a tech journalist. Ex. http://www.metasploit.com/users/opcode/syscalls.html
484.
by dguido 16y ago
iSEC Partners in NYC, San Francisco and Seattle http://www.isecpartners.com/careers/ "We are a security research and consulting company that is fortunate to work on some of the most interesting software products and problems in the world.
485.
by dguido 16y ago
The original-original source is here: https://media.blackhat.com/bh-eu-10/video/Marlinspike/BlackH...
486.
by dguido 16y ago
Ah, I see the site author still has his obnoxious bio at the bottom of every page. No better way to alienate content owners than to make it look like you're taking credit for every submitted video. Some time last year this Vivek guy actuall
487.
by dguido 16y ago
In related news, ex-spy who runs his own private c.i.a. no longer has any business due to being featured in the NYT.
488.
by dguido 16y ago
I love that despite all the Firesheep business, about half of the companies on that list don't even own an SSL certificate. :-(
489.
by dguido 16y ago
Basic version: The salt prevents an attacker from being able to pre-compute a mapping from password <-> hash value. It's most effective when it changes per-password and it doesn't matter if it's public. http://en.wikipedia.org/wiki
490.
by dguido 16y ago
Neat, I wonder how long before it shows up in 23andMe tests.
491.
by dguido 16y ago
It's C++. AFAIK it's built on top of the Foxit SDK.
492.
by dguido 16y ago
Other methods that are mentioned: Internal network access: - Internal DNS access - ARP spoofing - DNS Cache Poisoning - DHCP spoofing - TCP hijacking - Wi-Fi Access Point impersonation External network access: - Internal DNS access - DNS Ca
493.
by dguido 16y ago
true that. But AFAIK metasploit doesn't have exactly this kind of functionality. It would be nice if someone would port it though...
494.
by dguido 16y ago
Yeah, Virtual Infrastructure and VSphere clients download updates over HTTP from a URL that looks like: http://www.vmware.com/vmware<%RND1%>.exe
495.
by dguido 16y ago
You saw APT in the supported list right? :-P
496.
by dguido 16y ago
Adium definitely gets its update list over HTTP, so maybe it just prompts the user if the signatures don't match and lets them install anyway? The relevant module in evilgrade is sparkle.pm if you want to check it out.
497.
by dguido 16y ago
Here's the list of supported apps: * Freerip 3.30 * Jet photo 4.7.2 * Teamviewer 5.1.9385 * ISOpen 4.5.0 * Istat * Gom 2.1.25.5015 * Atube catcher 1.0.300 * Vidbox 7.5 * Ccleaner 2.30.1130 * Fcleaner 1.2.9.409 * Allmynotes 1.26 * Notepad++
498.
by dguido 16y ago
Disclaimer: I work for iSEC Partners and Chris Palmer has since left to work for Google. That shouldn't change the fact that the slide deck is awesome though.
499.
How to go SSL: "High Performance, Low Cost, and Strong Security: Pick Any Three"(web2expo.com)
3 points by dguido 16y ago|2 comments
500.
by dguido 16y ago
As the docs say, that's a property of internal phone storage (which is very limited). External storage doesn't have permissions. How could it? It's all FAT32!
501.
by dguido 16y ago
One of the exploited bugs is a default admin password in Siemens SCADA equipment. Siemens released a statement shortly after Stuxnet was discovered, urging admins not to change the default password because it might have unexpected consequen
502.
by dguido 16y ago
Yes, it has a C&C component. Symantec and others published a very thorough analysis of it near when Stuxnet was first discovered. Why do you think that it will have a short lifetime? Just because a patch is available, doesn't mean that
503.
by dguido 16y ago
It's impossible to identify any one target as being "the one" that Stuxnet was after like the author tries to do in this article. There were tens of thousands of Stuxnet infections spread throughout the Middle East and Europe at the time it
504.
by dguido 16y ago
This reminds me of Louis CK's "Everything's Amazing and Noboby's Happy" sketch: http://www.youtube.com/watch?v=8r1CZTLk-Gk
505.
by dguido 16y ago
If you want to help New Yorker's, you're going to have to make an option for "0" bedrooms, as that is quite common around here :-).
506.
by dguido 16y ago
"Cyber defense is often the opposite of a creative activity." Security can also be about identifying and mitigating risks to make a formerly unprofitable certain loss into a viable business opportunity. Big picture example: how many US bank
507.
by dguido 16y ago
Basically, what tptacek said. I don't know anyone from Aspect and they haven't contributed to the class in any way. I'm well aware of OWASP contributions to web security, I'm actually a board member for the NY/NJ chapter ( http://www.owasp.
508.
by dguido 16y ago
...which I promptly added to the post. Thanks Tom!
509.
by dguido 16y ago
Thanks Marcin! There was also some discussion of this article on Reddit too. Readers might want to check out some of the comments there: http://www.reddit.com/r/netsec/comments/cc4ye/information_se...
510.
by dguido 17y ago
I hate to be trendy when it comes to security, but home directory encryption makes "Evil Maid"-type attacks much easier. If I have 5 minutes with your laptop, I can replace/backdoor any system binaries you rely on and give the device back t

More ›