5041
The curious case of the Raspberry Pi in the network closet
Personal Blog of Christian Haschek
New
The latest blog posts to take off on Hacker News. 8,772 posts.
5042
An Almost-Secret Algorithm Researchers Used to Break Thousands of RSA Keys
RSA encryption allows for anyone to send me messages that only I can decode. To set this up, I select two large random primes $latex p$ and $latex q$ (each of which is hundreds of bits long), and r…
5043
Pwn2Own Vancouver 2019: Tesla, VMWare, Microsoft, and more
Starting in 2007, Pwn2Own has evolved from a small demonstration with prizes averaging around $10,000 per exploit, to one of the most well-known security contests in the industry, with millions of dollars of cash and prizes made available to contestants over the years. The contest serves as more tha
5044
5045
5046
Kubernetes Security Best Practices
By Connor Gilbert, product manager at StackRox Last month, the Kubernetes ecosystem was shaken by the discovery of the first major security flaw in Kubernetes, the world’s most popular container…
5047
5048
5049
GoDaddy injecting JavaScript into websites and how to stop it
I recently started having issues with the admin interface of a website I run and decided to check the browser console to see if any errors were being displayed there. There were and among them was an error stating that a JavaScript map file being loaded (and failing) that I did not recognise. This meant that the…
5050
5051
Metasploit 5.0 Released
We are happy to announce the release of Metasploit 5.0, the culmination of work by the Metasploit team over the past year. Learn more.
5052
5053
The State of Software Security in 2019
My goal in this post is to skim my observations on the state of software design and development over the past year, and to try to find a meaningful way forward for myself for 2019. My perspective is limited by the fact that I have worked exclusively in client-side software security for the past 7.5 years. Still, I…
5054
Modchips of the State
Collection of my projects and hacks.
5055
Why Telegram is insecure (2015)
Telegram, the encrypted messaging app loved by terrorists, has been in the news lately. Terrorists have long used existing commercial and…
5056
No-fly list trial: Court awards fees on government attorneys’ bad faith
Fourteen years to the day after she discovered she was on the no-fly list when she was arrested at SFO, and five years after her legal victory in the first trial of a challenge to a government no-fly order (a Pyrrhic victory as she has still been denied a visa to return to the US), Dr. Rahinah Ibrahim won a third…
5057
5058
A dive into the world of MS-DOS viruses
This post is a textual version of a talk I gave at The 35th Chaos Computer Congress at the end of 2018. You can watch the talk that was recorded by the wonderful C3VOC team below if that’s your preferred medium:
5059
5060
Exploiting the Math.expm1 typing bug in V8
Minus zero behaves like zero, right?
5061
Zero-knowledge attestation
U2F/FIDO tokens (a.k.a. “Security Keys”) are a solid contender for doing something about the effectiveness of phishing and so I believe they're pretty important. I've written a fairly lengthy introduction to them previously and, as mentioned there, one concerning aspect of their design is that they permit attestation…
5062
Let's Encrypt: Looking Forward to 2019
Let’s Encrypt had a great year in 2018. We’re now serving more than 150 million websites while maintaining a stellar security and compliance track record. Most importantly though, the Web went from 67% encrypted page loads to 77% in 2018, according to statistics from Mozilla. This is an incredible rate of change! We’d…
5063
5064
Fuzzing Like It’s 1989
With 2019 a day away, let’s reflect on the past to see how we can improve. Yes, let’s take a long look back 30 years and reflect on the original fuzzing paper, An Empirical Study of the Reliability of UNIX Utilities, and its 1995 follow-up, Fuzz Revisited, by Barton P. Miller. In this blog post, […]
5065
AdGuard DNS: A Privacy-Oriented DNS Server
AdGuard DNS: a privacy-oriented DNS service that blocks trackers and ads anywhere, from your PC and mobile devices to smart TV and IoT.
5066
How to Block Stingray Devices
Disable 2G On Android To Block Stingray Devices 1) Pull up the phone dialer and dial *#*#4636#*#* (that spells INFO) 2) This brings you to the testing screen, select "Phone/Device information". 3) Scroll down a little to "preferred network type", select the arrow. 4) Change it to LTE/WCDMA Only. It…
5067
5068
Evaluation of five password managers
With an interactive grid to help you pick one!
5069
5070