3631
New
The latest blog posts to take off on Hacker News. 4,337 posts.
3632
Downloading Software Safely Is Nearly Impossible
Let’s say you have a brand-new Windows laptop and you’re just oh, so happy. You’re pretty sure the NSA did not interdict it during shipment , and thus that it comes only with the flaky goatware Microsoft, Lenovo, and any number of Lenovo’s business partners intended for it to have. Now all you need is an SSH client so…
3633
TLS Symmetric Crypto
At this time last year, the TLS world was mostly running on RC4-SHA and AES-CBC. The Lucky 13 attack against CBC in TLS had just been published and I had spent most of January writing patches for OpenSSL and NSS to implement constant-time CBC decoding. The RC4 biases paper is still a couple of week away, but it's…
3634
Privacy Protects Bothersome People (2013)
We need to support privacy, not for those of us who have "nothing to hide", but for bothersome people like investigative journalists and activists, without which our democracy would crumble
3635
German freemail sites trick Firefox and Chrome users into removing AdBlock
German freemail heavyweights web.de and gmx.net (several millions of users combined) are using deceptive techniques in order to manipulate Firefox and Chrome users into removing AdBlock and its var…
3636
One of the Most Alarming Internet Proposals I've Seen
Previous: Warning: Network Solutions' Moronic Alert Email That Masquerades as a Phishing Attack
3637
On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Addition’ to NSA’s PRISM
Putting on my tinfoil hat.
3638
Apple's SSL/TLS bug
Yesterday, Apple pushed a rather spooky security update for iOS that suggested that something was horribly wrong with SSL/TLS in iOS but gave no details. Since the answer is at the top of the Hacker News thread, I guess the cat's out of the bag already and we're into the misinformation-quashing stage now.
3639
3640
3641
The New Normal: 200-400 Gbps DDoS Attacks
Over the past four years, KrebsOnSecurity has been targeted by countless denial-of-service attacks intended to knock it offline. Earlier this week, KrebsOnSecurity was hit by easily the most massive and intense such attack yet — a nearly 200 Gbps assault leveraging a simple attack method that industry experts say is…
3642
Cryptic Crossword: Amateur Crypto and Reverse Engineering
Reverse engineering is a special subgenre of computer programming. It's about the closest that I as a programmer get to being a scientist. Gather data, formulate a hypothesis, test, refine, repeat: reverse engineering is basically applying the scientific method to a very, very small knowledge domain. If you've never…
3643
The Insecurity of Secret IT Systems
We now know a lot about the security of the Rapiscan 522 B x-ray system used to scan carry-on baggage in airports worldwide. Billy Rios, director of threat intelligence at Qualys, got himself one and analyzed it. And he presented his results at the Kaspersky Security Analyst Summit this week. It’s worse than you might…
3644
3645
3646
3647
How I hacked Github again
This is a story about 5 Low-Severity bugs I pulled together to create a simple but high severity exploit, giving me access to private reposi...
3648
NBC Story about Hacking at Sochi is 100% Fraudulent
Yesterday (Feb 5 2014) On February 4th, NBC News ran a story claiming that if you bring your mobile phone or laptop to the Sochi Olympics...
3649
3650
Target Hackers Broke in via HVAC Company
Last week, Target told reporters at The Wall Street Journal and Reuters that the initial intrusion into its systems was traced back to network credentials that were stolen from a third party vendor. Sources now tell KrebsOnSecurity that the vendor in question was a refrigeration, heating and air conditioning…
3651
1971 Social Engineering Attack
From Betty Medsger’s book on the 1971 FBI burglary (page 22): As burglars, they used some unusual techniques, ones Davidon enjoyed recalling years later, such as what some of them did in 1970 at a draft board office in Delaware. During their casing, they had noticed that the interior door that opened to the draft…
3652
Hacking Airline Lounges for Free Meals
I think this is a great hack: A man bought a first-class ticket and used it to have free meals and drinks at the airport’s VIP lounge almost every day for nearly a year, Kwong Wah Yit Poh reported. The itinerary for the ticket was found to have been changed more than 300 times within a year, and the owner of the…
3653
3654
The Sad State of Mobile XMPP in 2014
blog about networking, cameras, old gear, and xmpp
3655
3656
Two "WontFix" vulnerabilities in Facebook Connect
TL;DR Every website with "Connect Facebook account and log in with it" is vulnerable to account hijacking. Every website relying on signed_r...
3657
3658
Google Calendar Unexpectedly Leaks Private Information
My wife likes to set reminders for herself in Google Calendar. Recently, she added a note to her personal Google Calendar reading "Email alice@example.com to discuss pay rise" and set the date for a few months from now. She'd had a discussion with her boss, Alice, and they'd agreed to talk about salary later in the…
3659
3660
Chrome Bugs Allow Sites to Listen to Your Private Conversations
New bugs in Google Chrome, allow malicious sites to activate your microphone, and listen in on anything said around your computer, even after you’ve left those sites.