3901
Google has indexed thousands of publicly accessible HP printers
A quick, well crafted Google search returns “About 86,800 results” for publically accessible HP printers.
New
The latest blog posts to take off on Hacker News. 4,337 posts.
3902
3903
3904
Securing Ubuntu
Table of Contents Initial Setup Setting up iptables and Fail2Ban Fail2Ban iptables rules Make shared memory read-only Setting up Bastille Linux Configuring Bastille sysctl hardening Setting up a chroot environment Securing nginx inside the chroot Extras Initial Setup Let’s login to our new machine and take some…
3905
3906
3907
Bypassing Gogo’s Inflight Internet Authentication
Two weeks ago I attended SIGCSE 2012 in Raleigh, NC. The plane on my return flight had Internet access through Gogo’s Inflight Internet. While I think it’s incredibly awesome that Internet access is readily available to those who travel by plane, I personally feel it is not worth …
3908
Please Stop Attacking MIT's Network
Today, at around 2:30 PM EST, Scripts went down. For most MIT students, this means a few class websites are inaccessible, a few friends' b...
3909
3910
3911
Joe Biden tried to ban email encryption back in 1991
There are rumors that the Obama campaign used an Ubuntu-based Linux distribution, though further analysis seems to indicate that these images were fakes. It would be great if someone from the Obama…
3912
Screenshot-proof images via temporal dithering
Snapchat 's (and now Facebook Poke 's) main claim to fame is that it lets you send "self-destructing" image messages. Setting aside the debate about the uses of this beyond sexting , the key vulnerability in both apps is the built-in ability to take screenshots. Both take a reactive approach, where you're notified if…
3913
The Doghouse: Crypteto
Crypteto has a 49,152-bit symmetric key: The most important issue of any encryption product is the ‘bit key strength’. To date the strongest known algorithm has a 448-bit key. Crypteto now offers a 49,152-bit key. This means that for every extra 1 bit increase that Crypteto has over its competition makes it 100%…
3914
3915
Feudal Security
It’s a feudal world out there. Some of us have pledged our allegiance to Google: We have Gmail accounts, we use Google Calendar and Google Docs, and we have Android phones. Others have pledged allegiance to Apple: We have Macintosh laptops, iPhones, and iPads; and we let iCloud automatically synchronize and back up…
3916
The EC2 firewall is broken
As most standards-aware network administrators know, blocking ICMP is evil. Sure, there are certain ICMP packets which should be blocked; but to quote RFC 2979 :
3917
3918
Disassembling the Woolworths Facebook scam
Who wants free stuff? C’mon, everybody wants a free lunch, right? Yes, yes they do and that’s precisely the trigger used in scams like this one. Recently I wrote about the mechanics of another Facebook scam [https://www.troyhunt.com/2012/10/she-did-what-in-school-mechanics-
3919
Bitsquatting: DNS Hijacking without exploitation
Researchers have exploited bit-errors before in amazing ways . But bit-errors can be detected and exploited in new ways on an Internet-wide scale. One of these means is by bitsquatting, or registering domain names one bit different than frequently resolved domains.
3920
3921
3922
Smuggling USB Sticks
"This Is Not A Film" by Iranian director Jafar Panahi, who is under house arrest in his country for alleged “propaganda against the regime,” will be screened under the Free Jafar Panahi Program of the 13th Cinemanila. The film was smuggled from Iran in a Flash-Drive hidden inside a cake to Cannes for screening a few…
3923
Visitor Tracking Without Cookies (or How To Abuse HTTP 301s)
A technique for abusing HTTP 301 redirects and random numbers to uniquely track users; even those who have cookies disabled in their web browsers.
3924
3925
Followup to "I bought more than 1 million Facebook data entries for $5"
Warning: According to Facebook you are not allowed to read this post, so beware.
3926
SSH key and passwordless login basics for developers
SSH keys are useful to login over ssh (secure shell) without typing a password. They are also used by Github and other version control systems for passwordless authentication. Here is some basic information from the software developer point of view how to use SSH keys for maximum comfort and security. These…
3927
The most dangerous code in the world
Abstract: SSL (Secure Sockets Layer) is the de facto standard for secure Internet communications. Security of SSL connections against an active network attacker depends on correctly validating public-key certificates presented when the connection is established. We demonstrate that SSL certificate validation is…
3928
Mozilla blogger bought 1 million Facebook entries (full name, e-mail) for $5
I have the bloody habit to look for cheap deals on some websites and today I’ve got the featured offer to buy more than 1 million Facebook entries containing Full Name, e-mail and Facebook profile URL. I make a quick check over the data and surprise, surprise: most of them are real and I even know some of those users.
3929
Introducing the USB Stick of Death
Several months back we have been playing with different file systems on various system platforms, examining the security posture and robustness of numerous device drivers’ implementations. One of the configurations we spent some time on was the commonly used NTFS on Microsoft Windows – as the file system is rather…
3930