2641
Qualcomm, National Security, and Patents
The Trump administration blocked Broadcom’s acquisition of Qualcomm, and I think it was the right move. Understanding why means understanding Qualcomm and Broadcom’s plan for the compan…
New
The latest blog posts to take off on Hacker News. 4,335 posts.
2642
Attacking Merkle Trees with a second preimage attack
Hacking, hardware, software, and general curiosities of computing machinery! Docendo discumus.
2643
TLS 1.3 and Proxies
I'll generally ignore the internet froth in a given week as much as possible, but when Her Majesty's Government starts repeating misunderstandings about TLS 1.3 it is necessary to write something, if only to have a pointer ready for when people start citing it as evidence.
2644
How Ethereum can be stolen through DNS rebinding
The Post has been moved here
2645
Master password in Firefox or Thunderbird? Do not bother
There is a weakness common to any software letting you protect a piece of data with a password: how does that password translate into an encryption key? If that conversion is a fast one, then you better don’t expect the encryption to hold. Somebody who gets hold of that encrypted data will try to guess the password…
2646
2647
Getting any Facebook user's friend list and partial payment card details
I enjoy breaking websites.
2648
How to dismantle a compiler bomb
You have heard of “zip bombs” (a tiny ZIP file that decompresses to multiple gigabytes) and “XML bombs” (small XML file abusing the entities to consume lots of memory), and …
2649
Notes on Analytics and Tracking in Onavo Protect for iOS
Recent media coverage of Onavo Protect encouraged me to investigate the code for the iOS version of their app. I wanted to determine what…
2650
2651
2652
GDPR – A Practical Guide for Developers (2017)
You’ve probably heard about GDPR. The new European data protection regulation that applies practically to everyone. Especially if you are working in a big company, it’s most likely that there’sContinue reading
2653
2654
2655
Why Searching Through 500M Pwned Passwords Is So Quick
In the immortal words of Ricky Bobby, I wanna go fast [https://www.youtube.com/watch?v=_qJGsSuFRIg]. When I launched Pwned Passwords V2 last week [https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/], I made it fast - real fast - and I want to talk briefly here
2656
E-Mail Leaves an Evidence Trail
If you’re going to commit an illegal act, it’s best not to discuss it in e-mail. It’s also best to Google tech instructions rather than asking someone else to do it: One new detail from the indictment, however, points to just how unsophisticated Manafort seems to have been. Here’s the relevant passage from the…
2657
2,800 New Data Breaches with 80M Records Added
tl;dr - a collection of nearly 3k alleged data breaches has appeared with a bunch of data already proven legitimate from previous incidents, but also tens of millions of addresses that haven't been seen in HIBP before. Those 80M records are now searchable, read on for the full story:
2658
Mark Felt-Tipped: Uncovering top-secret information by counting pixels
KEMUDITOTO merupakan official Situs Togel 4D & Toto TOGEL ONLINE Terjamin Maxwin dengan akses cepat, pilihan permainan lengkap, layanan responsif, dan nyaman digunakan setiap hari.
2659
2660
2661
Apple in China: who holds the keys?
Last week Apple made an announcement describing changes to the iCloud service for users residing in mainland China. Beginning on February 28th, all users who have specified China as their country/r…
2662
"Pwned Passwords" V2 With Half a Billion Passwords
Last August, I launched a little feature within Have I Been Pwned [https://haveibeenpwned.com/] (HIBP) I called Pwned Passwords [https://www.troyhunt.com/introducing-306-million-freely-downloadable-pwned-passwords/]. This was a list of 320 million passwords from a range of different data breaches which organisations…
2663
Money Laundering via Author Impersonation on Amazon
Patrick Reames had no idea why Amazon.com sent him a 1099 form saying he’d made almost $24,000 selling books via Createspace , the company’s on-demand publishing arm. That is, until he searched the site for his name and discovered someone has been using it to peddle a $555 book that’s full of nothing but gibberish.
2664
FlightSimLabs Alleged Malware Analysis
UPDATE: Two updates can be found at the bottom of this article revealing the findings from Fidus InfoSec and FSLabs’ response to the…
2665
2666
Spectre Mitigations in Microsoft's C/C++ Compiler
This form of Spectre can be used to attack a broad range of software -- operating systems, device drivers, web APIs, database systems, and almost anything else that receives untrusted input and may run on the same computer as untrusted code. Because large programs can contain literally millions of conditional branches…
2667
Making Light of the “Dark Web”
I'll start this post where I start many of my talks - what does a hacker look like? Or perhaps more specifically, what do people think a hacker looks like? It's probably a scary image, one that's a bit mysterious, a shady character lurking in the hidden depths
2668
2669
Sandboxed Mac apps can record screen any time without you knowing
I work with U.S. law firms as a non-testifying technical consulting expert on matters involving the Apple platform and iOS apps. Learn more about my litigation consulting.
2670
GitHub shouldn't allow username reuse
Update 2018-04-19 - GitHub has implemented some rules around retiring "namespaces".