4261
New
The latest blog posts to take off on Hacker News. 4,337 posts.
4262
Media Temple Hacked
I don’t normally do negative posts about another person or company, but I feel this needs to get out there. A few hours ago I received an email from MediaTemple , where I host several of my clients. It was an automated message informing me that:
4263
Virtual Mafia in Online Worlds
If you allow players in an online world to penalize each other, you open the door to extortion: One of the features that supported user socialization in the game was the ability to declare that another user was a trusted friend. The feature involved a graphical display that showed the faces of users who had declared…
4264
How Credit Card Numbers Are Generated
Visa,Master Card,Discover, and American Express credit card validation and generation techniques using the luhn algorithm.
4265
4266
H(m || k) also insecure, you really should use HMAC
The HMAC construction turns a cryptographic hash algorithm into a keyed hash. It is commonly used for integrity protection when the sender and recipient share a secret key. It was developed to addr…
4267
Arbitrary code execution via ldd utility
The `ldd` utility is more vulnerable than you think. It's frequently used by programmers and system administrators to determine the dynamic library dependencies of executables. Sounds pretty innocent, right? Wrong! In this article I am going to show you how to create an executable that runs arbitrary code if it's...
4268
New iPhone app piracy over week one.
If you know your way around a professional writers' room, you know how to use WritersRoom Pro ®
4269
A Tour Of A “Pay to Download Firefox” Site
At Mozilla , we regularly get anguished emails from people who have paid to download Firefox, and have then discovered a) that it's actually free, and b) that it's very hard to get the company they paid to stop charging their credit card. For those who have never had the misfortune to visit one of these trap sites, I…
4270
Evil Maid goes after TrueCrypt
From time to time it’s good to take a break from all the ultra-low-level stuff, like e.g. chipset or TXT hacking, and do something simple, y...
4271
Advanced SSH Techniques
At one site where I provide technical assistance, access to the network is all done via ssh over the Internet. However, one can't get access to the machines directly; one must first make an ssh connection to a gateway box I'll call martha. martha doesn't allow one to use regular passwords or keys, though. We're all…
4272
My GMail password scares me with its power
Google’s GMail blog has some “handy” advice on how pick a good password to project your email account. Don’t use dictionary words, use mixed case,…
4273
Abusing Amazon Images
Created May 21, 2005. Last updated January 10, 2014. Thanks to Aryeh Leib Taurog for the hover code.
4274
4275
4276
Complexity is insecurity
Complexity can be thought of as a type of code smell : It doesn't necessarily imply that there is a problem, but the presence of complexity is very strongly correlated with the presence of security vulnerabilities. In the design and construction of secure systems, it is important to not only consider mistakes which…
4277
4278
Twitter Exploit Still Works
I bet 10 years ago none of us thought that 140 characters would change the landscape of Social Media quite so much. However, with close to 289,000,000 active users sending around 6,000 tweets every second Twitter has proven its critics wrong. Obviously, having gotten over …
4279
Massive Twitter Cross-Site Scripting Vulnerability
I bet 10 years ago none of us thought that 140 characters would change the landscape of Social Media quite so much. However, with close to 289,000,000 active users sending around 6,000 tweets every second Twitter has proven its critics wrong. Obviously, having gotten over …
4280
4281
4282
Palm Pre Privacy Invasion
I've been taking a closer look at the WebOS side of my Palm Pre tonight, and I noticed that it periodically uploads information to Palm, Inc.
4283
Self-Enforcing Protocols
There are several ways two people can divide a piece of cake in half. One way is to find someone impartial to do it for them. This works, but it requires another person. Another way is for one person to divide the piece, and the other person to complain (to the police, a judge, or his parents) if he doesn’t think it’s…
4284
Write Down Your Password
Microsoft’s Jesper Johansson urged people to write down their passwords. This is good advice, and I’ve been saying it for years. Simply, people can no longer remember passwords good enough to reliably defend against dictionary attacks, and are much more secure if they choose a password too complicated to remember and…
4285
Crowdsourcing Bruteforcing: Help me win the EngineYard challenge
Short term financing makes it possible to acquire highly sought-after domains without the strain of upfront costs. Find your domain name today.
4286
"Goldman sachs code torrent" honeypot
.rar 32MB. A distributed real-time co-located high-frequency trading platform… A very low latency (microseconds) event-driven market data processing, strategy and order submission engine.
4287
Encrypt-then-MAC
First things first: Why use a composition of encryption and MAC instead of a single primitive which achieves both? Because people are very good at writing bad code. In my experience on the FreeBSD security team, writing dozens of security advisories, there are three types of code which are especially prone to have…
4288
Stop Password Masking
Usability suffers when users type in passwords and the only feedback they get is a row of bullets. Typically, masking passwords doesn't even increase security, but it does cost you business due to login failures.
4289
Tracking Down a Stolen iPhone
( Note: some screenshots are quite obviously simulated. ) ( Note 2: this is my first blog post in over three years, feel free to read my ancient history if you like. ) ( Note 3: All said and done, the comments and Internet-fame have been awesome. I'm moving on though. If you're interested, check…
4290