1441
Complete, Persistent Compromise of Netgear Wireless Routers
UPDATE: Turns out, Jacob Holocomb ( @rootHak42 on Twitter) of Independent Security Evaluators found this bug back in April on a different d...
New
The latest blog posts to take off on Hacker News. 1,615 posts.
1442
1443
Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
blog about networking, cameras, old gear, and xmpp
1444
Hostnames
The idea is to come up with some kind of category, so that people have something to remember all the names by. Some categories: Geographical (countries, cities, parks, rivers, lakes, streets), entertainment (flintsones, simpsons, disney films, celebrities), companies (hotels, airports, local shops, restarants)…
1445
1446
We scanned the Internet for port 22
Yesterday (Sept. 12) we scanned the entire Internet for port 22 -- the port reserved for "SSH", the protocol used by sysadmins to remotely l...
1447
New NSA Leak Shows MITM Attacks Against Major Internet Services
The Brazilian television show “Fantastico” exposed an NSA training presentation that discusses how the agency runs man-in-the-middle attacks on the Internet. The point of the story was that the NSA engages in economic espionage against Petrobras, the Brazilian giant oil company, but I’m more interested in the tactical…
1448
HTML Live Video Streaming Via WebSockets
When I built my Instant Webcam App, I was searching for solutions to stream live video from the iPhone's Camera to browsers. There were none.
1449
Building a PGP web of trust that people will actually use
Back in the early 1990s, PGP introduced the concept of web of trust (WoT)- a means by which users of personal encryption can know whether or...
1450
1451
Most TOR servers are vulnerable (NSA crackable)
After more revelations, and expert analysis, we still aren't precisely sure what crypto the NSA can break. But everyone seems to agree that...
1452
The First Few Milliseconds of an HTTPS Connection (2009)
Convinced from spending hours reading rave reviews, Bob eagerly clicked “Proceed to Checkout” for his gallon of Tuscan Whole Milk and…
1453
Let's remove verbs from HTTP 2.0
I shit you not – SPACEJUMP was a verb.
1454
Queueing in the Linux Network Stack
Things that interest me
1455
1456
Each socket should have two file descriptors
What if, instead of running a process-data program on this machine, we want to run it on another machine? No problem. We make a TCP connection to a process-data server on the remote machine. On the local machine, we have generate-data writing to the TCP connection, and consume-data reading from the TCP connection…
1457
Set up an email server in two hours
You may be concerned that the NSA is reading your e-mail. Is there really anything you can do about it though? After all, you don’t really want to move off of GMail / Google Apps. And no plac…
1458
1459
The 7-bit Internet
When I first started digging into the bowels of the Internet, I was fascinated by how many of its protocols—like HTTP and SMTP, for example—were entirely text based.
1460
1461
How to botch TLS forward secrecy
There's been some discussion about forward secret TLS recently, spurred, I think, by this piece from Declan McCullagh on CNET.
1462
1463
The network is reliable
I’ve been discussing Jepsen and partition tolerance with Peter Bailis over the past few weeks, and I’m honored to present this post as a collaboration between the two of us. We’d also like to extend our sincere appreciation to everyone who contributed their research and experience to this piece.
1464
SSH uses four TCP segments for each character you type
Every time we press a key in an interactive SSH session, the SSH Client sends that keystroke as a TCP segment to the SSH Server. Here is a Wireshark …
1465
Where did all the HTTP referrers go?
Good (and bad news): the general consensus in the web developer community is that any and every website should be HTTPS by default. Why? HTTP by itself isn't encrypted, leaving it open to eavesdropping, message tampering, and man-in-the-middle attacks. HTTPS, if you use it consistently , prevents these issues.
1466
A determined 'hacker' decrypts RDS-TMC
RDS-TMC uses an encryption algorithm simple enough to be run using pen-and-paper hardware.
1467
1468
Don't use Linksys routers
Back in 2012 I gave a talk at a conference titled Blended Threats and JavaScript . I demonstrated how anybody could design an internet worm that targeted common network devices like routers and turn them into a powerful botnet that is able to monitor traffic across all types of networks. For the pr
1469
ISP Advertisement Injection - CMA Communications
Apple Inc. endorsing H&R Block with a beautiful bright green banner ad, compliments of CMA Communications. Tired from the day’s ev...
1470
Comcast caught hijacking web traffic
On November 20th, 2012 Comcast hijacked my HTTP traffic and re-routed it through their own servers, injecting a “notice” on the page before completing the request. What this means is instead of my web request being routed to the website I wanted to visit, Comcast took it upon themselves to hijack my web…