31
New
The latest blog posts to take off on Hacker News. 91 posts.
32
"On communicating better" --- 37signals revises security pages.
Last week we were dragged over the coals — and rightfully so — for failing to communicate clearly regarding a security exploit that was discovered in early August. It turned out that the issue was related to Ruby on Rails. The exploit affected multiple products (ours and others). Aft…
33
34
Complexity is insecurity
Complexity can be thought of as a type of code smell : It doesn't necessarily imply that there is a problem, but the presence of complexity is very strongly correlated with the presence of security vulnerabilities. In the design and construction of secure systems, it is important to not only consider mistakes which…
35
36
Twitter Exploit Still Works
I bet 10 years ago none of us thought that 140 characters would change the landscape of Social Media quite so much. However, with close to 289,000,000 active users sending around 6,000 tweets every second Twitter has proven its critics wrong. Obviously, having gotten over …
37
Massive Twitter Cross-Site Scripting Vulnerability
I bet 10 years ago none of us thought that 140 characters would change the landscape of Social Media quite so much. However, with close to 289,000,000 active users sending around 6,000 tweets every second Twitter has proven its critics wrong. Obviously, having gotten over …
38
39
Infiltrating a Botnet - A Conversation With a Botmaster
Overview Defending a Customer from a Botmaster An Unsuspecting Customer Stopping the Bot Conversations with a Botmaster You Can Find Anything on the Internet One-Stop Botnet Shopping Pretense to Avoid Pwning Conclusion References Acknowledgments
40
41
42
Palm Pre Privacy Invasion
I've been taking a closer look at the WebOS side of my Palm Pre tonight, and I noticed that it periodically uploads information to Palm, Inc.
43
Self-Enforcing Protocols
There are several ways two people can divide a piece of cake in half. One way is to find someone impartial to do it for them. This works, but it requires another person. Another way is for one person to divide the piece, and the other person to complain (to the police, a judge, or his parents) if he doesn’t think it’s…
44
Write Down Your Password
Microsoft’s Jesper Johansson urged people to write down their passwords. This is good advice, and I’ve been saying it for years. Simply, people can no longer remember passwords good enough to reliably defend against dictionary attacks, and are much more secure if they choose a password too complicated to remember and…
45
Crowdsourcing Bruteforcing: Help me win the EngineYard challenge
Short term financing makes it possible to acquire highly sought-after domains without the strain of upfront costs. Find your domain name today.
46
"Goldman sachs code torrent" honeypot
.rar 32MB. A distributed real-time co-located high-frequency trading platform… A very low latency (microseconds) event-driven market data processing, strategy and order submission engine.
47
48
SSH server 0-day exploit
SANS.edu Internet Storm Center. Today's Top Story: The Classics Return: Vulnerable E-Mail Scripts;
49
50
Encrypt-then-MAC
First things first: Why use a composition of encryption and MAC instead of a single primitive which achieves both? Because people are very good at writing bad code. In my experience on the FreeBSD security team, writing dozens of security advisories, there are three types of code which are especially prone to have…
51
Stop Password Masking
Usability suffers when users type in passwords and the only feedback they get is a row of bullets. Typically, masking passwords doesn't even increase security, but it does cost you business due to login failures.
52
Tracking Down a Stolen iPhone
( Note: some screenshots are quite obviously simulated. ) ( Note 2: this is my first blog post in over three years, feel free to read my ancient history if you like. ) ( Note 3: All said and done, the comments and Internet-fame have been awesome. I'm moving on though. If you're interested, check…
53
54
55
56
Peter Selinger: MD5 Collision Demo
C:\TEMP> md5sum hello.exe cdc47d670159eef60916ca03a9d4a007 C:\TEMP> .\hello.exe Hello, world! (press enter to quit) C:\TEMP>
57
Cryptographic Right Answers
Encrypting data: Use AES in CTR (Counter) mode, and append an HMAC . AES is about as standard as you can get, and has done a good job of resisting cryptologic attacks over the past decade. Using CTR mode avoids the weakness of ECB mode, the complex (and bug-prone) process of padding and unpadding of partial blocks (or…
58
Corrupted Word Files for Sale
On one hand, this is clever: We offer a wide array of corrupted Word files that are guaranteed not to open on a Mac or PC. A corrupted file is a file that contains scrambled and unrecoverable data due to hardware or software failure. Files may become corrupted when something goes wrong while a file is being saved e.g…
59
60