1
IOHIDeous OS X Local Kernel Vulnerability
Siguza’s Blog
New
The latest blog posts to take off on Hacker News. 268 posts.
2
Call of Duty gaming community points to ‘swatting’ in Wichita police shooting
A 28-year-old Kansas man was shot and killed by police officers on the evening of Dec. 28 after someone fraudulently reported a hostage situation ongoing at his home. The false report was the latest in a dangerous hoax known as “ swatting ,” wherein the perpetrator falsely reports a dangerous situation at an address…
3
4
Cracking Encrypted PDFs
I performed a brute-force attack on the password of an encrypted PDF and a brute-force attack on the key of (another) encrypted PDF, both PDFs are part of a challenge published by John August. The …
5
The scrypt parameters
The recommended scrypt parameters in the Go docs were recently brought up for discussion given they haven’t changed since 2009.
6
LastPass’ Authenticator app is not secure
An easy, root-free way to bypass fingerprint protection on LastPass’ authenticator app
7
Hardening C/C++ Programs – Executable-Space Protection and ASLR
In the first part of this series we discussed the mechanics of an exploit, the general concept of hardening, and the stack protector hardening technique in particular. Some of the concepts explained there will be
8
9
Formal Verification: The Gap Between Perfect Code and Reality
Thanks to Vlad Brown and Drawings Team for Russian and Uzbek translations. In Fall 2017, I took MIT’s 6.826, Principles of Computer Systems, taught by Turing Award-winner Butler Lampson, Nickolai Z
10
The strange story of “Extended Random”
Yesterday, David Benjamin posted a pretty esoteric note on the IETF’s TLS mailing list. At a superficial level, the post describes some seizure-inducingly boring flaws in older Canon printers…
11
Netstat without netstat
Recently I was doing an assessment in a locked down and restricted environment. One of the first actions you tend to do when landing a shell on a [linux] box is to do some reconnaissance. This is both on host and network, as you want to determine what new access this host has given you. Normally you would run netstat…
12
Firefox 57 delays requests to tracking domains
Firefox Quantum - version 57 - introduced number of changes to the network requests scheduler. One of them is using data of the Tracking Protection database to delay load of scripts from tracking domains when possible during the time a page is actively loading and rendering - I call it tailing. This has a positive […]
13
Unravelling Konami's Arcade DRM
It’s well known that Konami doesn’t have complex protection on its arcade systems. Programmed World was a fan-made network replacement and update service for Konami arcade games with no support outside of Japan. Nothing of its scale and quality had been seen before, and nothing has been seen since, despite other…
14
15
16
HTTPS on Your Landing Page Is Important
Occasionally, I feel like I'm just handing an organisation more shovels - "here, keep digging, I'm sure this'll work out just fine..." The latest such event was with NatWest [http://personal.natwest.com] (a bank in the UK), and it culminated with this tweet from them: > I'm
17
How to break a Captcha system in 15 minutes with Machine Learning
Let’s hack the world’s most popular Wordpress CAPTCHA Plug-in
18
TP-Link firmware sends six DNS requests and one NTP query every 5 seconds
A design flaw in TP-Link Wi-Fi repeater firmware causes it to waste an excessive amount of bandwidth on NTP timekeeping. DDoS’ed public NTP servers in the process.
19
20
21
Decoding an air conditioner control's checksum with differential cryptanalysis
Back in 2009 I wrote an Arduino library ( IRRemote ) to encode and decode infrared signals for remote controls. I got an email recently fr...
22
The Trouble with Politicians Sharing Passwords
Yesterday I had a bunch of people point me at a tweet from a politician in the UK named Nadine Dorries [https://twitter.com/NadineDorries]. As it turns out, some folks were rather alarmed about her position on sharing what we would normally consider to be a secret. In this
23
Randomize your WiFi MAC address on Ubuntu
Your device’s MAC address can be used to track you across the WiFi networks you connect to. That data can be shared and sold, and often identifies you as an individual. It’s possible to limit this tracking by using pseudo-random MAC addresses.
24
What I'm Telling US Congress about Data Breaches
Last week I wrote about my upcoming congressional testimony [https://www.troyhunt.com/im-testifying-in-front-of-congress-in-washington-dc-about-data-breaches-what-should-i-say/] and wow - you guys are awesome! Seriously, the feedback there was absolutely sensational and it's helped shape what I'll
25
26
SSH vs. OpenVPN for Tunneling
Update 28.01.16 I found some sites referring to this post. Below are the common complaints I saw, and my replies:
27
From Markdown to remote code execution in Atom
Recently I took a look at Atom, a text editor by GitHub. With a little bit of work, I was able to chain multiple vulnerabilities in Atom into an actual Remote Code Execution. The vulnerabiliti…
28
I'm Testifying to Congress about Data Breaches – What Should I Say?
Edit: I'm putting this up front as a lot of people are asking for it - the hearing will be live-streamed on YouTube and there's already an embedded video on the hearing page [https://energycommerce.house.gov/hearings/identity-verification-post-breach-world/] . There's a title I
29
Switching from 1Password to Bitwarden
I've been using an OpenBSD laptop as my workstation a lot more lately, probably because most of my hardware just works now and I don't have to think too much about it. The touchpad works when I touch it, I can be confident that when I close the lid, the laptop will fully suspend and then fully resume again when I open…
30
