3601
New
The latest blog posts to take off on Hacker News. 4,337 posts.
3602
The Linux Security Circus: On GUI isolation
There certainly is one thing that most Linux users don't realize about their Linux systems... this is the lack of GUI-level isolation, and ...
3603
3604
3605
A New Development for Coverity and Heartbleed
Byte swapping does not necessarily imply the data comes from an external source. For example, when writing graphics code, you sometimes need to do byte swapping if you’re converting between 24-bit RGB and BGR image formats (Windows’ GDI famously uses BGR so this is one place where you need to do such conversions)…
3606
Heartbleed and Static Analysis
The issue with things like Frama-C is that they are by far the easiest to use if you start out a project using them, and you often don’t know which projects you retroactively wished you had done so until they are big and crufty.
3607
Preventing heartbleed bugs with safe programming languages
The Heartbleed bug in OpenSSL has resulted in a fair amount of damage across the internet. The bug itself was quite simple and is a textbook case for why programming in unsafe languages like C can be problematic. As an experiment to see if a safer systems programming language could have prevented the bug I tried…
3608
3609
Tarsnap: No heartbleed here
There's a few reasons for this. First, the Tarsnap client-server protocol does not use TLS; instead, it uses a protocol which is about 100x simpler (in terms of the number of pages of documentation required to define it). This means there's less code and far fewer edge cases where bugs can lurk without being triggered…
3610
3611
3612
Heartbleed
Heartbleed is a catastrophic bug in OpenSSL: “The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of…
3613
My Heart Bleeds for OpenSSL
Overview Today has been eventful, to say that least. My colleague and I patched several services, re-issued keys for them and started the ...
3614
3615
Hijacking user sessions with the Heartbleed vulnerability
The Heartbleed issue is actually worse than it might immediately seem (and it seems pretty bad already).
3616
3617
3618
3619
3620
We may have witnessed a NSA "Shotgiant" TAO-like action
Last Friday, the New York Times reported that the NSA has hacked/infiltrated Huawei, a big Chinese network hardware firm. We may have witne...
3621
3622
How to design an elliptic-curve signature system
Earlier this month a new paper by Naomi Benger, Joop van de Pol, Nigel Smart, and Yuval Yarom hit the news . The paper explains how to recover secret keys from OpenSSL's implementation of ECDSA-secp256k1 using timing information from "as little as 200 signatures"; ECDSA-secp256k1 is the signature system used by…
3623
3624
3625
How To Safely Generate A Random Number
Use urandom. That is the whole answer. Why the entropy-depletion story is a myth, and why userspace CSPRNGs are behind most of the last decade's randomness disasters.
3626
How to steal Bitcoins that are protected by weak passphrases
Every Bitcoin address is based on a secret key, from which the public key (associated to a Bitcoin address) is calculated. Once you have the private key for an address, you have the control of that address and can use it to transfer funds.
3627
Google Exploit – Steal Account Login Email Addresses
I found a bug that allowed me to find anyone with a Google+ account's login email address. This could be used to target specific people for spear phishing.
3628
Myths about /dev/urandom
Randomness, entropy, and the Linux kernel.
3629
3630
2,000 NHS Security Vulnerabilities Disclosed
This is part 3 of a series of blog posts looking at the security of the UK Government's web infrastructure. Britain's National Health Service is riddled with old and insecure WordPress-based websites. Many of these sites have severe flaws including being vulnerable to XSS attacks. There is absolutely no suggestion…