513 reputation
315
bio website sitewat.ch
location Teresina, Brazil
age
visits member for 3 years, 2 months
seen May 6 at 16:57

Do not trust any security related answers you see on SO. Not from me, not from anyone. There are very smart people on SO and there are excellent answers given, although the right answer is almost never chosen. Test everything, trust no one.

I have been writing exploit code for more than 5 years. I have found numerous vulnerabilities. I have received three severity metrics from the Department of Homeland Security. The most severe is in the top 500 more dangerous software flaws of all time.

My CVE numbers:

CVE-2011-0050 CVE-2011-0049 CVE-2011-0048 CVE-2009-1759 CVE-2009-0468 CVE-2009-0467 CVE-2009-0389 CVE-2008-6975 CVE-2008-6499 CVE-2008-6498 CVE-2008-5621 CVE-2008-2043 CVE-2008-2002 CVE-2007-6485 CVE-2007-6458 CVE-2007-6459 CVE-2007-6471 CVE-2007-5646 CVE-2007-0134 CVE-2007-0132 CVE-2007-0130 CVE-2006-6781 CVE-2006-6780 CVE-2006-3208 CVE-2006-3207 CVE-2006-3206 CVE-2006-3205 CVE-2006-3204 CVE-2006-3203


Dec
20
comment What is an easy method of proving that a cryptographic oracle attack is possible?
As a penetration tester my job is to prove that software is insecure.
Dec
18
comment What is an easy method of proving that a cryptographic oracle attack is possible?
I want the best method that that can be applied in a scientific way. If this is the best, then so be it.
Dec
5
comment Ensuring integrity of a client side script
@Barry Steyn Well people try, look at the xbox... and look at all of the pirated games for the xbox.
Dec
4
comment AES encrypting multiple files
+1 i love that scrypt paper.
Dec
3
revised What is an easy method of proving that a cryptographic oracle attack is possible?
added 15 characters in body
Dec
3
comment What is an easy method of proving that a cryptographic oracle attack is possible?
@Paŭlo Ebermann♦ good question. The attacker, no more no less.
Dec
3
answered AES Secure key generation and storage
Dec
3
asked What is an easy method of proving that a cryptographic oracle attack is possible?
Dec
3
revised Ensuring integrity of a client side script
added 98 characters in body
Dec
3
answered Ensuring integrity of a client side script
Oct
26
comment Does chaining random number generators lead to loss of randomness?
@Inemesit Affia that is a question for crypto.se
Oct
26
answered Does chaining random number generators lead to loss of randomness?
Sep
5
accepted How is block cipher padding verified for consistancy?
Aug
31
comment How is block cipher padding verified for consistancy?
+1 Great answer, but I still have some questions. There appears to be some sanity checks for null byte padding, does this also lead to a padding oracle attack?
Aug
31
accepted Malleability attacks against encryption without authentication
Aug
27
comment Malleability attacks against encryption without authentication
+1 creative attack
Aug
26
comment Malleability attacks against encryption without authentication
Are you suggesting that if I replace ciphertext block N-1 with A⊕B⊕(ciphertext block N-1) I will have the message B for the plain text block N?
Aug
26
comment Malleability attacks against encryption without authentication
+1 good stuff. PKCS7 would severally undermine this attack.
Aug
26
asked How is block cipher padding verified for consistancy?
Aug
26
comment Malleability attacks against encryption without authentication
How is padding checked for consistency? Do you know of a good paper that explains this?