3721
Complete, Persistent Compromise of Netgear Wireless Routers
UPDATE: Turns out, Jacob Holocomb ( @rootHak42 on Twitter) of Independent Security Evaluators found this bug back in April on a different d...
New
The latest blog posts to take off on Hacker News. 4,337 posts.
3722
Experian Sold Consumer Data to ID Theft Service
An identity theft service that sold Social Security and drivers license numbers — as well as bank account and credit card data on millions of Americans — purchased much of its data from Experian , one of the three major credit bureaus, according to a lengthy investigation by KrebsOnSecurity.
3723
3724
3725
SecureDrop
SecureDrop is an open-source whistleblower support system, originally written by Aaron Swartz and now run by the Freedom of the Press Foundation. The first instance of this system was named StrongBox and is being run by The New Yorker. To further add to the naming confusion, Aaron Swartz called the system DeadDrop…
3726
Bitcoin as a law enforcement/natsec honeypot: what is the evidence?
Paranoia appears to be the order of the day, given what we know about the NSA and GCHQ thanks to Edward Snowden. Absent from the stories so...
3727
Insecurities in the Linux /dev/random
New paper: “Security Analysis of Pseudo-Random Number Generators with Input: /dev/random is not Robust, by Yevgeniy Dodis, David Pointcheval, Sylvain Ruhault, Damien Vergnaud, and Daniel Wichs. Abstract: A pseudo-random number generator (PRNG) is a deterministic algorithm that produces numbers whose distribution is…
3728
Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
blog about networking, cameras, old gear, and xmpp
3729
3730
Faking Bluetooth LE
Dmitry.GR: Creating BTLE-compliant advertisement packets, so that iOS and android devices can see and parse them.
3731
Nordstrom Finds Cash Register Skimmers
Scam artists who deploy credit and debit card skimmers most often target ATMs, yet thieves can also use inexpensive, store-bought skimming devices to compromise modern-day cash registers. Just this past weekend, for instance, department store chain Nordstrom said it found a half-dozen of these skimmers affixed to…
3732
Air Gaps
Since I started working with Snowden’s documents, I have been using a number of tools to try to stay secure from the NSA. The advice I shared included using Tor, preferring certain cryptography over others, and using public-domain encryption wherever possible. I also recommended using an air gap, which physically…
3733
Anonymity Is Hard
Anonymity in the real world is very hard In late 2011 Hezbollah rolled up a CIA spy ring in Lebanon. This provides an interesting lesson in CIA …
3734
Piercing Through WhatsApp’s Encryption
WhatsApp has been plagued by numerous issues in their security: easily stolen passwords, unencrypted messages and even a website that can change anyone’s status. But that streak is not yet over.
3735
Time-lock encryption
How do you encrypt a file such that it can be decrypted after a date, but not before? Use serial computations for proof-of-work using successive squaring, chained hashes, or witness encryption on blockchains.
3736
Fingerprints are Usernames, not Passwords
As one of the maintainers of eCryptfs , and a long time Thinkpad owner, I have been asked many times to add support to eCryptfs for Th...
3737
Senator Feinstein Admits the NSA Taps the Internet Backbone
We know from the Snowden documents (and other sources) that the NSA taps the Internet backbone through secret agreements with major US telcos., but the US government still hasn’t admitted it. In late August, the Obama administration declassified a ruling from the Foreign Intelligence Surveillance Court. Footnote 3…
3738
3739
3740
Metadata Equals Surveillance
Back in June, when the contents of Edward Snowden’s cache of NSA documents were just starting to be revealed and we learned about the NSA collecting phone metadata of every American, many people—including President Obama—discounted the seriousness of the NSA’s actions by saying that it’s just metadata. Lots and lots…
3741
RSA warns developers not to use RSA products
In today’s news of the weird, RSA (a division of EMC) has recommended that developers desist from using the (allegedly) ‘backdoored’ Dual_EC_DRBG random number generator — w…
3742
Beginner's Guide to Wi-fi Interception
You know how security people get all uppity about SSL this and SSL that? Stuff like posting creds over HTTPS isn’t enough, you have to load login forms over HTTPS as well and then you can’t send auth cookies over HTTP because they’ll get sniffed and sessions
3743
Verizon, caught red-handed
Verizon has now on multiple occasions refused to connect my Google Nexus 7 LTE tablet, though the device was publicized widely as working on Verizon and...
3744
Dear USA, my data has left your building
NSA, GCHQ, Prism, FISA, Project Bullrun, Sigint. After Edward Snowden, former CIA and NSA employee, started revealing how massively, intensely and easily we are all being spied upon by the intelligence agencies of various governments, the terms above have suddenly been spending a great deal more time in the media…
3745
3746
We scanned the Internet for port 22
Yesterday (Sept. 12) we scanned the entire Internet for port 22 -- the port reserved for "SSH", the protocol used by sysadmins to remotely l...
3747
New NSA Leak Shows MITM Attacks Against Major Internet Services
The Brazilian television show “Fantastico” exposed an NSA training presentation that discusses how the agency runs man-in-the-middle attacks on the Internet. The point of the story was that the NSA engages in economic espionage against Petrobras, the Brazilian giant oil company, but I’m more interested in the tactical…
3748
3749
Don't trust me: I might be a spook
But the latest revelations scare me. It's one thing to find and exploit vulnerabilities in software; there's a lot of software out there which was written by developers with very little understanding of cryptography or software security, and it shows. If you care about security, we reasoned, stick to software written…
3750
Dropbox disables ASLR on Windows
Dropbox has become a daily part of my life. I rely on it to synchronise data between my growing set of devices. But how much of an impact does it have on the security of my system? I decided to fin…