2461
New
The latest blog posts to take off on Hacker News. 4,335 posts.
2462
The State of Software Security in 2019
My goal in this post is to skim my observations on the state of software design and development over the past year, and to try to find a meaningful way forward for myself for 2019. My perspective is limited by the fact that I have worked exclusively in client-side software security for the past 7.5 years. Still, I…
2463
Modchips of the State
Collection of my projects and hacks.
2464
Why Telegram is insecure (2015)
Telegram, the encrypted messaging app loved by terrorists, has been in the news lately. Terrorists have long used existing commercial and…
2465
A dive into the world of MS-DOS viruses
This post is a textual version of a talk I gave at The 35th Chaos Computer Congress at the end of 2018. You can watch the talk that was recorded by the wonderful C3VOC team below if that’s your preferred medium:
2466
2467
Exploiting the Math.expm1 typing bug in V8
Minus zero behaves like zero, right?
2468
Zero-knowledge attestation
U2F/FIDO tokens (a.k.a. “Security Keys”) are a solid contender for doing something about the effectiveness of phishing and so I believe they're pretty important. I've written a fairly lengthy introduction to them previously and, as mentioned there, one concerning aspect of their design is that they permit attestation…
2469
2470
How to Block Stingray Devices
Disable 2G On Android To Block Stingray Devices 1) Pull up the phone dialer and dial *#*#4636#*#* (that spells INFO) 2) This brings you to the testing screen, select "Phone/Device information". 3) Scroll down a little to "preferred network type", select the arrow. 4) Change it to LTE/WCDMA Only. It…
2471
2472
How the Dreamcast Copy Protection Was Defeated
After I shipped the DOOM Black Book , I took some vacation in Japan where I was able to play Ikaruga on a real arcade at Taito HEY in Akihabara. The experience reignited my interest in SEGA's ultimate video game console, the Dreamcast. There is a lot of documentation available online which made the studying process…
2473
HTTPS in the real world
In cryptography, trust is mathematically provable. Everything else is just faith.
2474
Maximizing password manager attack surface
Kaspersky Password Manager uses a unique approach to maximize the attack surface. A quick introduction.
2475
Major sites running unauthenticated JavaScript on their payment pages
A few months ago, British Airways' customers had their credit card details stolen. How was this possible? The best guess goes something like this: BA had 3rd party JS on its payment page <script src="https://example.com/whatever.js"></script> The 3rd party's site was hacked, and the JS was changed. BA's customers ran…
2476
The Digital Maginot Line
There is a war happening. We are immersed in an evolving, ongoing conflict: an Information World War in which state actors, terrorists, and ideological…
2477
2478
“Stylish” is back, and you still shouldn't use it
2 days after I published ‘“Stylish” browser extension steals all your internet history’, Stylish was pulled from the Chrome and Firefox stores. The story echoed around parts of the internet for a few days, my name was misspelled on several right-wing British news websites, and I felt that I’d helped make the world a…
2479
Half of All Phishing Sites Now Have the Padlock
Maybe you were once advised to “look for the padlock” as a means of telling legitimate e-commerce sites from phishing or malware traps. Unfortunately, this has never been more useless advice. New research indicates that half of all phishing scams are now hosted on Web sites whose Internet address includes the padlock…
2480
GDPR complaints against Google’s deceptive practices to track user location
Based on new research published today by BEUC’s Norwegian member Forbrukerrådet, seven consumer groups are filing complaints against Google with their national data protection authorities.
2481
Scammers are changing the contact details for banks on Google Maps
A new type of banking scam involving fake business listings is taking over Google [3 min read]
2482
Advanced web security topics
(Updated 22 May 2020) This post discusses web security issues that I come across – so far thankfully mostly by reading about them. It is a work in progress which I’ll keep updating. The…
2483
Shamir’s Secret Sharing Scheme
Consider a scenario in which you are tasked with managing the security of a bank's vault. The vault is considered impenetrable without a key, which you are g...
2484
2485
2486
Beyond Passwords: 2FA, U2F and Google Advanced Protection
Last week I wrote a couple of different pieces on passwords, firstly about why we're going to be stuck with them for a long time yet [https://www.troyhunt.com/heres-why-insert-thing-here-is-not-a-password-killer/] and then secondly, about how we all bear some
2487
Hacking Gmail’s UX with 'From' Fields – Another Phishing Vector
An Unexpected Consequence of a Bad Header
2488
Capsicum
I spent a couple of years evangelizing about Capsicum. I wrote many articles about it. So, it is very natural that I would also like to update you on this blog about the progress of the Capsicum project in FreeBSD, because this is what I’m doing in my free time. That said I feel that this blog wouldn’t be completed…
2489
Android Security Auditing: Investigating Unauthorized Screenshots
About six months ago, I discovered something on my smartphone that horrified me: I went to undelete a file in DiskDigger, and I stumbled upon a plethora of unexpected jpegs: screenshots of my activity. Screenshots that I didn’t take. Screenshots of my conversations. Screenshots of my GPS position. And screenshots of…
2490
U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service
A year ago, KrebsOnSecurity warned that “Informed Delivery,” a new offering from the U.S. Postal Service (USPS) that lets residents view scanned images of all incoming mail, was likely to be abused by identity thieves and other fraudsters unless the USPS beefed up security around the program and made it easier for…