2791
Patching is hard; so what?
It’s now been about a week since Equifax announced the record-breaking breach that affected 143 million Americans. We still don’t know enough — but a few details have begun to com…
New
The latest blog posts to take off on Hacker News. 4,335 posts.
2792
Equihax
Trawling the darknet as one does, I came across this little simple page this morning. It claims to be the real EQUIFAX hackers, unlike the last darknet site that was soon taken down by morons. I ha…
2793
Face ID, Touch ID, No ID, PINs and Pragmatic Security
I was wondering recently after poring through yet another data breach how many people actually use multi-step verification. I mean here we have a construct where even if the attacker has the victim's credentials, they're rendered useless once challenged for the authenticator code or SMS which is
2794
How I snatched 153k Ether after a bad Tinder date
Over the weekend, I did a lot of swiping right. I’ve never had a Tinder go this fast from match to agreeing on a date time this fast…
2795
2796
Equifax Argentinian portal secured with admin/admin
Equifax last week disclosed a historic breach involving Social Security numbers and other sensitive data on as many as 143 million Americans. The company said the breach also impacted an undisclosed number of people in Canada and the United Kingdom. But the official list of victim countries may not yet be complete…
2797
Curl’s backdoor threat
-- "Have you ever detected anyone trying to add a backdoor to curl?" -- "Have you ever been pressured by an organization or a person to add suspicious code to curl that you wouldn't otherwise accept?" -- "If a crime syndicate would kidnap your family to force you to comply, what backdoor would you be … Continue…
2798
A Hardware Privacy Monitor for iPhones
Andrew “bunnie” Huang and Edward Snowden have designed a hardware device that attaches to an iPhone and monitors it for malicious surveillance activities, even in instances where the phone’s operating system has been compromised. They call it an Introspection Engine, and their use model is a journalist who is…
2799
Mastercard Internet Gateway Service: Hashing Design Flaw
Last year I found a design error in the MD5 version of the hashing method used by Mastercard Internet Gateway Service. The flaw allows modification of transaction amount. They have awarded me with a bounty for reporting it. This year, they have switched to HMAC-SHA256, but this one also has a flaw
2800
2801
Cryptographic vulnerabilities in IOTA
Last month, Ethan Heilman, Tadge Dryja, Madars Virza, and I took a look at IOTA, currently the 8th largest cryptocurrency with a $1.9B…
2802
Playing with Kernel TLS in Linux 4.13 and Go
The 1600 LoC patch allows userspace to pass the kernel the encryption keys for an established connection, making encryption happen transparently inside the kernel.
2803
2804
Twitter Bots Use Likes, RTs for Intimidation
I awoke this morning to find my account on Twitter ( @briankrebs ) had attracted almost 12,000 new followers overnight. Then I noticed I’d gained almost as many followers as the number of re-tweets (RTs) earned for a tweet I published on Tuesday . The tweet stated how every time I tweet something related to Russian…
2805
Restic Cryptography
tl;dr: this is not an audit and I take no responsibility for your backups, but I had a quick look at the crypto and I think I’m going to use restic for my personal backups.
2806
The qmail security guarantee
Of course, ``security hole in qmail'' does not include problems outside of qmail: for example, NFS security problems, TCP/IP security problems, DNS security problems, bugs in scripts run from .forward files, and operating system bugs generally. It's silly to blame a problem on qmail if the system was already…
2807
2808
I'm giving up on HPKP
HTTP Public Key Pinning is a very powerful standard that allows a host to instruct a browser to only accept certain public keys when communicating with it for a given period of time. Whilst HPKP can offer a lot of protection, it can also cause a lot of harm too.
2809
Cracking random number generators (xoroshiro128+)
In software, we generate random numbers by calling a function called a "random number generator". Such functions have hidden states, so that repeated calls to the function generate new numbers that appear random. If you know this state, you can predict all future outcomes of the random number generators. O'Neill, a…
2810
Examining a vintage RAM chip, I find a counterfeit with a different die inside
A die photo of a vintage 64-bit TTL RAM chip came up on Twitter recently, but the more I examined the photo the more puzzled I became. The c...
2811
Security Keys
Security Keys are (generally) USB-connected hardware fobs that are capable of key generation and oracle signing. Websites can “enroll” a security key by asking it to generate a public key bound to an “appId” (which is limited by the browser based on the site's origin). Later, when a user wants to log in, the website…
2812
Don't Take Security Advice from SEO Experts or Psychics
As best I understand it, one of the most effective SEO things you can do is to repeat all the important words on your site down the bottom of the page. To save it from looking weird, you make the text the same colour as the background so people can'
2813
How to confirm a Google user’s specific email address
I reported an issue to Google, which allows an attacker to confirm whether someone is logged in to any one of a list of specific Google accounts.
2814
Pastes on Have I Been Pwned are no longer publicly listed
Over the weekend, a Have I Been Pwned [https://haveibeenpwned.com/] (HIBP) subscriber contacted me after they found their Spotify credentials online. It turns out that this particular woman went searching for her specific password after finding "some guy listening to Mexican music from a foreign device on my acct"
2815
Kids Pass Just Reminded Us How Hard Responsible Disclosure Is
Only a couple of months ago, I did a talk titled "The Responsibility of Disclosure: Playing Nice and Staying Out of Prison". The basic premise was to illustrate where folks finding security vulnerabilities often go wrong in their handling of the reporting, but I also wanted to show how organisations
2816
2817
Regarding Marcus Hutchins aka MalwareTech
Brief background
2818
2819
300M Freely Downloadable Pwned Passwords
Edit 1: The following day, I loaded another set of passwords which has brought this up to 320M. More on why later on. Edit 2: The API model described below has subsequently been discontinued [https://www.troyhunt.com/enhancing-pwned-passwords-privacy-by-exclusively-supporting-anonymity/] in favour of the
2820
How I implemented my own crypto
Despite advice to the contrary, I have implemented my own crypto for serious use. Here's how.