1
New
The latest blog posts to take off on Hacker News. 236 posts.
2
On Hacking MicroSD Cards
Today at the Chaos Computer Congress ( 30C3 ), xobs and I disclosed a finding that some SD cards contain vulnerabilities that allow arbitrary code execution — on the memory card itself. On the dark side, code execution on the memory card enables a class of MITM (man-in-the-middle) attacks, where the card seems to be…
3
The UK "Porn" Filter Blocks Kids' Access To Tech, Civil Liberties Websites
It fell to the UK Tories to actually implement the Nanny State. Too bad Nanny Tory does not want kinds to read up on tech web sites, or civi...
4
XSS in Gmail through Rapportive
A blog on security, malware, cryptography, pentesting, javascript, php and whatnots
5
6
Who's Selling Credit Cards From Target
The previous two posts on this blog have featured stories about banks buying back credit and debit card accounts stolen in the Target hack and that ended up for sale on rescator[dot]la , a popular underground store. Today’s post looks a bit closer at open-source information on a possible real-life identity for the…
7
Geohot presents an evasi0n7 writeup
Hi, I'm on a plane from SFO to New York, and made something for you. Not even a rap song. ******* geohot( @tomcr00se ) presents an evasi0n7 writeup ******* == Intro == I was bored, reversed, wrote this write-up, and wanted to do something with it. I tried to sell it to the Chinese for $7 and a trip to the Pizza Hut…
8
Blackmail fail
In which the author receives surprising offers from kind strangers
9
Smartphone can use its microphone to extract RSA decryption key from laptop
This is neat: Here, we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG’s current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of…
10
11
12
An update on Truecrypt
Several people have been asking for an update on our public audit of the Truecrypt disk encryption software. I’m happy to say that the project is on track and proceeding apace. Here I wanted …
13
14
15
The Fallacy of Cracking Contests (1998)
In this issue: The Fallacy of Cracking Contests How to Recognize Plaintext News The Doghouse: Iomega Zip Disks Counterpane Systems News Final Report from the Commerce Department Technical Advisory Committee on Key Recovery Comments From Readers About "CRYPTO-GRAM"
16
17
Bitcoin Private Key Necromancy
tl;dr: https://github.com/pierce403/keyhunter ~ The Longer Version ~ A few weeks ago, a friend came to me with a problem. Way back...
18
19
20
21
The NSA: An Inside View
In which I relate my experience as an NSA employee and impart my thoughts on the policies in place, my former coworkers, and the current cyber war.
22
How to send DMs on Twitter without permission
I just recalled " SMS commands " feature and tried to send a DM (private, direct message) with "Share on Twitter"-button. It works! Twitt...
23
24
Is Unicode Safe?
Unicode is just too complex to ever be secure.  — Bruce Schneier, 2000 Over the last 25 years Unicode has succeeded. It hasn't displaced all other character encodings, but it's clearly on its way there. It's supported widely enough that it's a compatible choice, new projects use it, and it's becoming the…
25
Evading Airport Security
The news is reporting about Evan Booth, who builds weaponry out of items you can buy after airport security. It’s clever stuff. It’s not new, though. People have been explaining how to evade airport security for years. Back in 2006, I—and others—explained how to print your own boarding pass and evade the photo-ID…
26
27
RJS leaking vulnerability in multiple Rails applications
I wrote about this problem in May, without showcases, just a theoretical post http://homakov.blogspot.com/2013/05/do-not-use-rjs-like-techn...
28
29
30
