1
Extracting the SuperFish certificate
I extracted the certificate from the SuperFish adware and cracked the password (" komodia ") that encrypted it. I discuss how down below. T...
Errata Security
This post from last year was posted to a forum, so I thought I'd write up some rebuttals to their comments.
- Popular posts
- 23
- Total points
- 6,023
- HN comments
- 2,443
- Rank
- #159 personal
Visit blog.erratasec.com → RSS feedOn Hacker News Sep 2013 – Feb 2020
Security & Privacy 18Society, Policy & Culture 7Networking & Internet 5Software Engineering 4Web & Frontend 3Hardware & Electronics 2
2
Some notes about HTTP/3
HTTP/3 is going to be standardized. As an old protocol guy, I thought I'd write up some comments. Google (pbuh) has both the most popular ...
3
NBC Story about Hacking at Sochi is 100% Fraudulent
Yesterday (Feb 5 2014) On February 4th, NBC News ran a story claiming that if you bring your mobile phone or laptop to the Sochi Olympics...
4
Secret Dots from Printer Outed NSA Leaker
Today, The Intercept released documents on election tampering from an NSA leaker. Later, the arrest warrant request for an NSA contractor ...
5
X86 is a high-level language
Just so you know, x86 machine-code is now a "high-level" language. What instructions say, and what they do, are very different things. I m...
6
Pin-pointing China's attack against GitHub
For the past week, the website "GitHub" has been under attack by China. In this post, I pin-point where the attack is coming from by doing a...
7
Can I drop a pacemaker 0day?
Can I drop a pacemaker 0day at DefCon that is capable of killing people? Computers now run our cars. It's now possible for a hacker to i...
8
Bash 'shellshock' bug is wormable
Early results from my scan: there's about 3000 systems vulnerable just on port 80, just on the root "/" URL, without Host field. That doesn'...
9
Systemd is bad parsing
Systemd has a remotely exploitable bug in its DHCPv6 client . That means anybody on the local network can send you a packet and take control...
10
Why we have to boycott RSA
The only thing stopping corporations from putting NSA backdoors into their products is the risk of getting caught. RSA got caught backdoorin...
11
Reading the Silk Road configuration
Many of us believe it wasn't the FBI who discovered the hidden Silk Road server, but the NSA (or other intelligence organization). We believ...
12
We may have witnessed a NSA "Shotgiant" TAO-like action
Last Friday, the New York Times reported that the NSA has hacked/infiltrated Huawei, a big Chinese network hardware firm. We may have witne...
13
You are committing a crime right now (2012)
Are you reading this blog? If so, you are committing a crime under 18 USC 1030(a) (better known as the “ Computer Fraud & Abus...
14
How to decrypt WhatsApp end-to-end media files
At the center of the "Saudis hacked Bezos" story is a mysterious video file investigators couldn't decrypt, sent by Saudi Crown Prince MBS t...
15
Jamming XKeyScore
Back in the day there was talk about "jamming echelon" by adding keywords to email that the echelon system was supposedly looking for. We ca...
16
Dear Obama, from Infosec
Dear President Obama: We are more than willing to believe Russia was responsible for the hacked emails/records that influenced our electio...
17
My Raspberry Pi cluster
So I accidentally ordered too many Raspberry Pi's. Therefore, I built a small cluster out of them. I thought I'd write up a parts list for o...
18
Exploiting the Superfish certificate
As discussed in my previous blogpost, it took about 3 hours to reverse engineer the Lenovo/Superfish certificate and crack the password. In...
19
We scanned the Internet for port 22
Yesterday (Sept. 12) we scanned the entire Internet for port 22 -- the port reserved for "SSH", the protocol used by sysadmins to remotely l...
20
“Security problems are primarily just bugs”
People are debating this email from Linus Torvalds (maintainer of the Linux kernel). It has strong language, like: Some security people ...
21
Bash 'shellshock' scan of the Internet
NOTE: malware is now using this as their User-agent. I haven't run a scan now for over two days. I'm running a scan right now of the I...
22
Most TOR servers are vulnerable (NSA crackable)
After more revelations, and expert analysis, we still aren't precisely sure what crypto the NSA can break. But everyone seems to agree that...
23
How The Intercept Outed Reality Winner
Today, The Intercept released documents on election tampering from an NSA leaker. Later, the arrest warrant request for an NSA contractor ...