391
Security releases issued
Posted by James Bennett on Feb. 19, 2013
New
The latest blog posts to take off on Hacker News. 431 posts.
392
Mandiant Exposes APT1, One of China’s Cyber Espionage Units
Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.
393
Using Silk Road
History, background, visiting, ordering, using, & analyzing the drug market Silk Road 1
394
395
396
397
398
Linux Foundation Secure Boot System Released
As promised, here is the Linux Foundation UEFI secure boot system. This was actually released to us by Microsoft on Wednesday 6 February, but with travel, conferences and meetings I didn’t really get time to validate it all until today. The files are here
399
400
401
402
Keeping Passwords in Source Control
I learned a neat tip from my co-worker, Craig Silverstein ( more on Craig joining Khan Academy ), recently and I thought others might find it to be useful.
403
404
1% of CMS-Powered Sites Expose Their Database Passwords (2011)
Feross Aboukhadijeh is a computer security researcher, teacher, web developer, designer, long distance runner, gamer, music lover, and builder of websites that (sometimes) go viral.
405
Deconstruction of Pinkie Pie's 64-bit Chrome exploit
Back in November 2012, a Chrome Releases blog post mysteriously stated: "Congratulations to Pinkie Pie for completing challenge: 64-bit exp...
406
On Python security amidst recent Rails/YAML vulnerabilities
The Rails community has had a few high-profile security issues this week. They are well-summarized, with an alarming list of what follow-ons to expect, by Patrick McKenzie: What the Rails Security Issue Means for Your Startup.
407
408
409
410
Who Does Skype Let Spy?
Lately I’ve been thinking a lot about power and the Internet, and what I call the feudal model of IT security that is becoming more and more pervasive. Basically, between cloud services and locked-down end-user devices, we have less control and visibility over our security—and have no point but to trust those in power…
411
Mozilla Recognized as Most Trusted Internet Company for Privacy
I’m very happy to share that Mozilla has been named the Most Trusted Internet Company for Privacy in 2012, according to a study performed by the Ponemon
412
IDIV DoS (INT_MIN / -1)
A little fun for the last day of 2012: how to crash a program via division? x86’s IDIV instruction traps not only on division by zero, but also on INT_MIN / -1 (signed integer overflow).
413
Google has indexed thousands of publicly accessible HP printers
A quick, well crafted Google search returns “About 86,800 results” for publically accessible HP printers.
414
415
Megafail
In case you’ve been living under a rock the past few days, Kim Dotcom (of Megaupload infamy) has launched his new cloud storage site, Mega. Mega has an impressive sales pitch, promising secure cloud storage where only the user has the key to decrypt his or her files, and the encryption and decryption happens securely…
416
417
Securing Ubuntu
Table of Contents Initial Setup Setting up iptables and Fail2Ban Fail2Ban iptables rules Make shared memory read-only Setting up Bastille Linux Configuring Bastille sysctl hardening Setting up a chroot environment Securing nginx inside the chroot Extras Initial Setup Let’s login to our new machine and take some…
418
419
420
The Prosecution of Aaron: A Response to Orin Kerr
Aaron Swartz committed suicide last week. He was 26, a genius and my friend. Not a really good friend, but someone I had worked with off and on for 11 years, liked a lot, had laughed with frequently, occasionally shaken my head over and deeply admired. When I first met him he looked like this.