3211
Advanced Tor Browser Fingerprinting
The ability to privately communicate through the internet is very important for dissidents living under authoritary regimes, activists and basically everyone concerned about internet privacy.
New
The latest blog posts to take off on Hacker News. 4,337 posts.
3212
Widespread XSS Vulnerabilities in Ad Network Code
For most of us, the title of this post may not be very surprising. Any time we allow 3rd party scripts to run on our sites, we effectively relinquish control of the code that executes on the client. This is particularly important when integrating ad network scripts since they are inherently more dynamic than most…
3213
3214
3215
The FBI can almost certainly crack the San Bernardino iPhone without Apple
The title kind of says it all. How do I know? Because of this photo : That's a picture of the logic board of an iPhone 5C, the same mod...
3216
This is why people fear the Internet of Things
Imagine buying an internet-enabled surveillance camera, network attached storage device, or home automation gizmo, only to find that it secretly and constantly phones home to a vast peer-to-peer (P2P) network run by the Chinese manufacturer of the hardware. Now imagine that the geek gear you bought doesn’t actually…
3217
3218
OpenSSL CVE-2016-0799: heap corruption via BIO_printf
There are a couple of issues with OpenSSL’s BIO_*printf() functions, defined in crypto/bio/b_print.c, that are set to be fixed in the forthcoming security release. The function that is primar…
3219
Outlook 2016’s New POP3 Bug Deletes Your Emails
Yikes, looks like the new version of Outlook 20016 has broken the POP3 implementation. If you are currently using the “leave on server and delete after x days” function, the you should check your account because it seems like that the new Outlook is actually deleting your emails almost immediately after retrieving…
3220
3221
Controlling vehicle features of Nissan LEAFs remotely via vulnerable APIs
Last month I was over in Norway doing training for ProgramUtvikling, [http://programutvikling.no/] the good folks who run the NDC conferences I've become so attached to. I was running my usual “Hack Yourself First” workshop [https://www.troyhunt.com/2016/02/more-europe-even-more-again-and-more.
3222
HTTP GZIP Compression remote date and time leak
Tor is a service run by a network of volunteers to allow people to use internet anonymously. Normally tor is used to browse the web without being tracked or identified.
3223
Distribution packages considered insecure
If you ever have run a Linux-based operating system you are probably aware of the way that software is usually distributed on them: Using a software repository. Repositories are great for numerous …
3224
3225
Early Impacts of Let's Encrypt
During the months I worked in Let's Encrypt's operations team I got fairly used to being the go-to man for any question that a database query could solve.…
3226
Reverse engineering Android from binary to source
Dmitry.GR: Full sources for Android on zWatch
3227
3228
3229
What Is the Secure Enclave?
The big tech news this week is that the FBI is trying to force Apple to unlock a suspect's iPhone. One of the interesting points around this story is that the iPhone in question is an older one, an iPhone 5c. Newer phones have what Apple calls the Secure Enclave, which some say protects against requests of this…
3230
Automatically inferring file syntax with afl-analyze
The nice thing about the control flow instrumentation used by American Fuzzy Lop is that it allows you to do much more than just, well, f...
3231
Why I stopped using StartSSL (Hint: it involves a Chinese company)
StartSSL uses https://auth.startssl.com/ for the front-end to access to their PKIs (login to the PKI, create, revoke certificates...). It's the Core of their service and the critical part of their infrastructure.
3232
The dark side of big data
Everybody (1, 2, 3) is talking about big data and the chances that are not to be missed. So it would be fatal to miss this opportunity, for instance, by impo...
3233
SSH: Best practices
The comments around the last OpenSSH issue ( CVE 2016-0777 , you must read excellent Qualys’ analysis if you’re interested with the details), I noticed that many people were not aware of some basic features of OpenSSH. I will attempt to give a few advises, prioritized in feasibility order, and with graphical…
3234
The Internet of Things Will Be the World's Biggest Robot
The Internet of Things is the name given to the computerization of everything in our lives. Already you can buy Internet-enabled thermostats, light bulbs, refrigerators, and cars. Soon everything will be on the Internet: the things we own, the things we interact with in public, autonomous things that interact with…
3235
UCOP Ordered Spyware Installed on UC Data Networks
The San Francisco Chronicle has coverage of an issue that has been circulating on faculty email networks at UC Berkeley for a few days. ...
3236
How Plex is doing HTTPS for all its users
This week Plex , a self-hosted media server, announced that they now offer TLS to secure all connections, including those to the user’s servers. This is actually pretty interesting.
3237
Some OS X Applications Vulnerable to MITM Attacks
Facebook bug bounty and story behind a vulnerability
3238
OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
Usual Mandatory Disclaimer: IANAC (I am not a cryptographer) so I might likely end up writing a bunch of mistakes in this blog post... ...
3239
NTP Pool Bad Actors: The Rising Sophistication of Network Scanning
Gone are the days when computers didn't need firewalls. We are now living in an internet security arms race and your personal information ...
3240
Why I’m not speaking at CPDP: It’s the privacy-washing
13 Jan, 2016 The sponsorship of privacy and human rights conferences by corporations that erode our privacy and human rights is a clear conflict of interests that we must challenge. The revolution will not be sponsored by those we are revolting against.