361
New
The latest blog posts to take off on Hacker News. 391 posts.
362
Two "WontFix" vulnerabilities in Facebook Connect
TL;DR Every website with "Connect Facebook account and log in with it" is vulnerable to account hijacking. Every website relying on signed_r...
363
Did this Tor developer become a victim of NSA's laptop interception program?
UPDATE (1/27/14) : Shepard says she reached out to the seller and was told they entered the wrong tracking number. She hasn't received the package yet. She also says the new tracking details show that it has now been sent to Seattle, but to the wrong zip code, and "didn't ship until after [she] got the original…
364
365
HTTP Security headers you should be using
Van Pathé tot KLM en de Rijksoverheid: ontdek hoe Dawn Technology met maatwerk software alledaagse ervaringen slimmer, sneller en beter maakt.
366
Google Calendar Unexpectedly Leaks Private Information
My wife likes to set reminders for herself in Google Calendar. Recently, she added a note to her personal Google Calendar reading "Email alice@example.com to discuss pay rise" and set the date for a few months from now. She'd had a discussion with her boss, Alice, and they'd agreed to talk about salary later in the…
367
368
Chrome Bugs Allow Sites to Listen to Your Private Conversations
New bugs in Google Chrome, allow malicious sites to activate your microphone, and listen in on anything said around your computer, even after you’ve left those sites.
369
TCP backdoor 32764 – how we could patch the Internet (or part of it)
Eloi Vanderbéken recently found a backdoor on some common routers, which is described on his GitHub here. Basically, a process that listens on the 32764 TCP port runs, sometimes accessible from the WAN interface. We scanned the v4 Internet to look for the routers that have this backdoor wild open, and gathered some…
370
Apparently It’s OK For iOS Apps To Ask For Your Apple ID And Password
Upon first launch, Sunrise invites you to create an account, then asks you to add a calendar. The first option, “iCloud Calendar”, brings you to a screen where the Sunrise app itself, in its native interface and code, solicits your Apple ID (iCloud) email address and password.
371
SSL Labs: Stricter security requirements for 2014
Today, we're releasing a new version of SSL Rating Guide as well as a new version of SSL Test to go with it. Because the...
372
Snowden-haters are on the wrong side of history
In the autumn on 1963, J. Edgar Hoover’s FBI, worried at Martin Luther King’s growing influence, began tapping his phones and bugging his hotel rooms. They hoped to discredit him by gai…
373
Kids, this is story of How I Met... my VPS hacked
Just recently I published my technical goals for 2014 and one of them was to learn more about security. Well it couldn’t have been more appropriate, my Virtual Private Server (VPS) just got hacked, for the second time (I use the VPS to host a Java web application). The first time, I basically rebuilt my server and…
374
How Jason Bourne Stores His Bitcoin
If you want to invest in bitcoin for the long-haul, you should address the thorny issue of how best to store them. Since people love stealing bitcoins from others more than just about anything else in this world, all storage systems must first and foremost:
375
Account hijacking on MtGox
If it wasn't MtGox I wouldn't even mention it — XSS/fixation/etc are web sec routines, and are not worth a blog post. But it *is* MtGox. W...
376
Cookie Bomb or Let's Break the Internet
TL;DR I can craft a page "polluting" CDNs, blogging platforms and other major networks with my cookies. Your browser will keep sendin...
377
378
Today I Briefed Congress on the NSA
This morning, I spent an hour in a closed room with six members of Congress: Rep. Lofgren, Rep. Sensenbrenner, Rep. Bobby Scott, Rep. Goodlatte, Rep. Mike Thompson, and Rep. Amash. No staffers, no public: just them. Lofgren had asked me to brief her and a few Representatives on the NSA. She said that the NSA wasn’t…
379
TrueCrypt Master Key Extraction And Volume Identification
One of the disclosed pitfalls of TrueCrypt disk encryption is that the master keys must remain in RAM in order to provide fully transparent...
380
How the NSA Threatens National Security
Secret NSA eavesdropping is still in the news. Details about once secret programs continue to leak. The Director of National Intelligence has recently declassified additional information, and the President’s Review Group has just released its report and recommendations. With all this going on, it’s easy to become…
381
FFmpeg and a thousand fixes
Posted by Mateusz Jurczyk and Gynvael Coldwind, Information Security Engineers At Google, security is a top priority - not only for our ow...
382
Malicious Use of the HTML5 Vibrate API
There is a new API in town! HTML5 will (soon) let you make the user's device vibrate. What fun! Obviously, it's useful for triggering alerts, improved immersivness during gameplay, and all sorts of other fun things like sending Morse Code messages via vibration. At the moment, Chrome (and other Android browsers) ask…
383
Root a Mac in 10 seconds or less
Often times, physical access to a machine means game over. While people like to think that OSX is immune to most security threats, even Apple computers can be susceptible to physical attacks. Mac OSX is capable of booting into single user mode by holding a special key combination (Command-S). From this point, an…
384
385
This working group has failed
Search IETF mail list archives
386
Why we have to boycott RSA
The only thing stopping corporations from putting NSA backdoors into their products is the risk of getting caught. RSA got caught backdoorin...
387
388
How printers and Photoshop detect and refuse to process images of currency
Professor Steven J. Murdoch
389
390
Dual_EC_DRBG backdoor: a proof of concept
Dual_EC_DRBG is an pseudo-random number generator promoted by NIST in NIST SP 800-90A and created by NSA. This algorithm is problematic because it has been made mandatory by the FIPS norm (and should be implemented in every FIPS approved software) and some vendors even promoted this algorithm as first source of…