Reputation
1,669
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
2 13 29
Impact
~134k people reached

  • 0 posts edited
  • 1 helpful flag
  • 174 votes cast
Jul
26
comment What is the funniest firewall rule set?
Wow, how is this not a real question?
Jul
24
comment Securely installing Wordpress in a subdirectory on a server
haha, security and wordpress in the same sentence. If you use wordpress your screwed and there is nothing you can do about it. I have looked at the code and i have reported vulnerabilities that project, their idea of secuirty is a joke.
Jul
24
comment Preventing programmer from copying information
@PaulWaldman As long as the contractor is in the US you can sue him, there is nothing else you can do. (i like how you didn't post an answer :)
Jul
18
comment Is there a windows equivalent to chroot?
@Nathan Adams I agree, but "security in layers".
Jul
18
comment Is there a windows equivalent to chroot?
@MarkM Interesting, but with the grsecuirty improvements the only method of breaking out would be to rip a hole into kernel land, which could be done buffer overflow in linux (or whatever kernel you are using).
Jul
18
comment Is there a windows equivalent to chroot?
@MarkM So you would say that a chroot isn't a security system? Also, that attack doesn't work on a grsecurity chroot (grsecurity.net).
Jul
18
comment Is there a windows equivalent to chroot?
One of my processes was poorly written and very insecure, management doesn't want to fix it because it would be "too expensive". I expect this process to get owned eventually and i want to limit the impact on my system. If you really believe there is nothing to gain, then you must read more about chroots.
Jul
5
comment Sockets found by lsof but not by netstat
@Robert Munteanu You have to set break points upon socket creation and look at the stack trace and memory at that point. I suspect you are falling into an infinite loop. Being able to look at any variable and step though your code is going to be the best approach for complex problems like this.
Jul
4
comment Sockets found by lsof but not by netstat
@Robert Munteanu If you are building this app thenthis is a question for stackoverflow. Never the less you are opening too many sockets.
Jun
29
comment What risks are associated with allowing anonymous access from the LAN to the internet?
@Evan Anderson it isn't clear if that is his configuration, although even with only HTTP access you can piss of the DoD and get a nasty C&D in the mail.
Jun
29
comment R, PHP & Apache
Sounds like your hosting company sucks.
Jun
28
comment My site seems to be hijacked… but only when visited from another site… how?
@Zoredache your right that the problem could be an issue with configuration or a vulnerability in another service. However many exploits work regardless of configuration or security settings, such as sql injection. Even with AppArmor and SELinux a system can still be exploited easily.
Jun
17
comment Why shouldn't root be allowed to login via ssh?
because its old and no one uses it.
Jun
14
comment compromised site
@Longpoke The Register called this exploit an Apocalyptic Infection (theregister.co.uk/2010/05/11/phpnuke_infection_purged). Thats a great complement for any security researcher but I prefer the title "masSEXploitation". I guess Russian mob like candy :)
Jun
14
comment compromised site
@Longpoke AppArmor and SElinux are more like a chroot than a canary, its another layer of access control that is per-process instead of per user/group. And btw i just got accepted to speak at Defcon and i'll be talking about the AppArmor bypass that i used in my exploit :)
Jun
14
comment compromised site
@Longpoke (AppArmor<=SELinux && ASLR/SSP!=AppArmor)
Jun
14
comment compromised site
@Longpoke If you look at these exploitation methods discussed in these 2 papers I think you'll agree that it would be difficult to pull this off in some kind of super worm thats able to break any vulnerable site. ngssoftware.com/papers/HackproofingMYSQL.pdf securereality.com.au/studyinscarlet.txt
Jun
14
comment compromised site
@Longpoke Ubuntu's AppArmor rule sets jail MySQL from writing to the web root. SELinux under rhel/fedora does something very similar. I am actually working with ubuntu to fix a AppArmor Bypass issue that i have discovered. The worm could be doing a vulnerability scan and exploiting common RCE issues (RFI/eval()/file_put_contents()), and this is more likely that sql injection, and i recommend running a vuln scan (w3af is pretty sick). Although i suspect these criminals are more simplistic.
Jun
14
comment compromised site
+1 good link. Its well known that GoDaddy has some major problems with security.
Jun
14
comment compromised site
@Longpoke I am happy to discuss exploit development, however i do not appreciate these comments when you do not have a better answer.