211
State Considered Harmful – A Proposal for a Stateless Laptop
Two months ago I have published a detailed survey of varioussecurity-related problems plaguing the Intel x86 platforms. While the picturepainted in the paper...
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 684 posts.
212
Using the HTML5 Fullscreen API for Phishing Attacks
Feross Aboukhadijeh is a computer security researcher, teacher, web developer, designer, long distance runner, gamer, music lover, and builder of websites that (sometimes) go viral.
213
Pledge() and unveil() in SerenityOS (2020)
This post describes the implementation and use of pledge() and unveil() in SerenityOS.
214
Zerocoin: making Bitcoin anonymous
Wow, what the heck is going on with Bitcoin? When I started this post, the value of a single bitcoin had surged upwards of $250. It’s corrected a bit since then (down $100 or so), but it̵…
215
No Copyright Intended
On October 26, a YouTube user named crimewriter95 posted a full-length version of Pulp Fiction, rearranged in chronological order. A couple things struck me about this video. First, I’m surprised that a full-length, 2.5-hour very slight remix of a popular film can survive on YouTube for over six weeks without getting…
216
The RubyGems "Security Incident"
Ruby Central posted an extremely concerning “Incident Response Timeline” today, in which they make a number of exaggerated or purely misleading claims. Here’s my effort to set the record straight. First, and most importantly: I was a primary operator of RubyGems.org, securely and successfully, for over ten years. Ruby…
217
Extended Validation Certificates Are Really Dead
Almost one year ago now, I declared extended validation certificates dead [https://www.troyhunt.com/extended-validation-certificates-are-dead/]. The entity name had just been removed from Safari on iOS, it was about to be removed from Safari on Mojave and there were indications that Chrome would remove it
218
219
On the Perceived Value of EV Certs, Commercial CAs, Phishing and Let's Encrypt
Last week I wrote about how Life Is About to Get a Whole Lot Harder for Websites Without HTTPS [https://www.troyhunt.com/life-is-about-to-get-harder-for-websites-without-https/]. Somewhere in the comments there, the discussion went off on a tangent about commercial CAs, the threat
220
How Dropbox sacrifices user privacy for cost savings
Note: This flaw is different than the authentication flaw in Dropbox that Derek Newton recently published . Summary Dropbox , the popular cl...
221
222
Encrypt-then-MAC
First things first: Why use a composition of encryption and MAC instead of a single primitive which achieves both? Because people are very good at writing bad code. In my experience on the FreeBSD security team, writing dozens of security advisories, there are three types of code which are especially prone to have…
223
Why Is This Website Port Scanning Me?
Investigation of the practice of port scanning site visitors for fingerprinting and tracking.
224
Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years
Hundreds of millions of Facebook users had their account passwords stored in plain text and searchable by thousands of Facebook employees — in some cases going back to 2012, KrebsOnSecurity has learned. Facebook says an ongoing investigation has so far found no indication that employees have abused access to this data.
225
Zero-day in Sign in with Apple
What if I say, your Email ID is all I need to takeover your account on your favorite website or an app. Sounds scary, right? This is what a…
226
227
The “Cobra Effect” that is disabling paste on password fields
Back in the day when the British had a penchant for conquering the world, they ran into a little problem on the subcontinent; cobras. Turns out there were a hell of a lot of the buggers wandering around India and it also turned out that they were rather venomous which
228
Why are anime catgirls blocking my access to the Linux kernel?
Hey… quick question, why are anime catgirls blocking my access to the Linux kernel?
229
230
Apple Exclaves
Enhancing kernel isolation, one step at a time.
231
232
Don't run 'strings' on untrusted files
Many shell users, and certainly most of the people working in computer forensics or other fields of information security, have a habit of ru...
233
Ubiquiti developer charged with extortion, causing 2020 “breach”
Last year, I posted a series of articles about a purported “breach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press.
234
GDPR – A Practical Guide for Developers (2017)
You’ve probably heard about GDPR. The new European data protection regulation that applies practically to everyone. Especially if you are working in a big company, it’s most likely that there’sContinue reading
235
236
Running the "Reflections on Trusting Trust" Compiler
Supply chain security is a hot topic today, but it is a very old problem. In October 1983, 40 years ago this week, Ken Thompson chose supply chain security as the topic for his Turing award lecture, although the specific term wasn’t used back then. (The field of computer science was still young and small enough that…
237
Intel x86 considered harmful – survey of attacks against x86 over last 10 years
Back in summer I have read a new bookpublished by one of the core Intel architects about the Management Engine (ME).I didn’t quite like what I read there. In...
238
Who is Anna-Senpai, the Mirai Worm Author?
On September 22, 2016, this site was forced offline for nearly four days after it was hit with “ Mirai ,” a malware strain that enslaves poorly secured Internet of Things (IoT) devices like wireless routers and security cameras into a botnet for use in large cyberattacks. Roughly a week after that assault, the…
239
Psychic Paper: iOS Sandbox Escape
Siguza’s Blog
240
