8131
New
The latest blog posts to take off on Hacker News. 8,776 posts.
8132
Bank of America Telephone Access Security Hole
"I can assure you that they would not be able to do that with the Bank of America security." The words of the Bank of America supervisor echoed in our
8133
You are committing a crime right now
Are you reading this blog? If so, you are committing a crime under 18 USC 1030(a) (better known as the “ Computer Fraud & Abus...
8134
Disassembling the Woolworths Facebook scam
Who wants free stuff? C’mon, everybody wants a free lunch, right? Yes, yes they do and that’s precisely the trigger used in scams like this one. Recently I wrote about the mechanics of another Facebook scam [https://www.troyhunt.com/2012/10/she-did-what-in-school-mechanics-
8135
Bitsquatting: DNS Hijacking without exploitation
Researchers have exploited bit-errors before in amazing ways . But bit-errors can be detected and exploited in new ways on an Internet-wide scale. One of these means is by bitsquatting, or registering domain names one bit different than frequently resolved domains.
8136
Security Incident on FreeBSD Infrastructure
From: FreeBSD Security Officer < security-officer@FreeBSD.org > To: FreeBSD Security < FreeBSD-security@FreeBSD.org > Bcc: freebsd-announce@freebsd.org , freebsd-security-notifications@FreeBSD.org Reply-To: secteam@FreeBSD.org Subject: Security Incident on FreeBSD Infrastructure
8137
8138
8139
Smuggling USB Sticks
"This Is Not A Film" by Iranian director Jafar Panahi, who is under house arrest in his country for alleged “propaganda against the regime,” will be screened under the Free Jafar Panahi Program of the 13th Cinemanila. The film was smuggled from Iran in a Flash-Drive hidden inside a cake to Cannes for screening a few…
8140
Visitor Tracking Without Cookies (or How To Abuse HTTP 301s)
A technique for abusing HTTP 301 redirects and random numbers to uniquely track users; even those who have cookies disabled in their web browsers.
8141
Google Address Sanitizer ("compile-time valgrind") to be part of GCC 4.8
This is the mail archive of the gcc-patches@gcc.gnu.org mailing list for the GCC project .
8142
8143
Followup to "I bought more than 1 million Facebook data entries for $5"
Warning: According to Facebook you are not allowed to read this post, so beware.
8144
SSH key and passwordless login basics for developers
SSH keys are useful to login over ssh (secure shell) without typing a password. They are also used by Github and other version control systems for passwordless authentication. Here is some basic information from the software developer point of view how to use SSH keys for maximum comfort and security. These…
8145
The most dangerous code in the world
Abstract: SSL (Secure Sockets Layer) is the de facto standard for secure Internet communications. Security of SSL connections against an active network attacker depends on correctly validating public-key certificates presented when the connection is established. We demonstrate that SSL certificate validation is…
8146
Mozilla blogger bought 1 million Facebook entries (full name, e-mail) for $5
I have the bloody habit to look for cheap deals on some websites and today I’ve got the featured offer to buy more than 1 million Facebook entries containing Full Name, e-mail and Facebook profile URL. I make a quick check over the data and surprise, surprise: most of them are real and I even know some of those users.
8147
Introducing the USB Stick of Death
Several months back we have been playing with different file systems on various system platforms, examining the security posture and robustness of numerous device drivers’ implementations. One of the configurations we spent some time on was the commonly used NTFS on Microsoft Windows – as the file system is rather…
8148
8149
8150
Master Keys
Earlier this month, a retired New York City locksmith was selling a set of “master keys” on eBay: Three of the five are standard issue for members of the FDNY, and the set had a metal dog tag that was embossed with an FDNY lieutenant’s shield number, 6896. The keys include the all-purpose “1620,” a master firefighter…
8151
8152
GET /browser.exe
Jon Howell dreams of a new Internet. In this new Internet, cross-browser compatibility checking is a distant memory and new features can be unilaterally be added to browsers without having to convince the world to upgrade first. The idea which makes this Internet possible is so crazy, it just might work.
8153
8154
Using the HTML5 Fullscreen API for Phishing Attacks
Feross Aboukhadijeh is a computer security researcher, teacher, web developer, designer, long distance runner, gamer, music lover, and builder of websites that (sometimes) go viral.
8155
When Will We See Collisions for SHA-1?
On a NIST-sponsored hash function mailing list, Jesse Walker (from Intel; also a member of the Skein team) did some back-of-the-envelope calculations to estimate how long it will be before we see a practical collision attack against SHA-1. I’m reprinting his analysis here, so it reaches a broader audience. According…
8156
8157
8158
Did NSA Put a Secret Backdoor in New Encryption Standard? (2007)
Random numbers are critical for cryptography: for encryption keys, random authentication challenges, initialization vectors, nonces, key-agreement schemes, generating prime numbers and so on. Break the random-number generator, and most of the time you break the entire security system. Which is why you should worry…
8159
Bank of America Giving Access to Random Accounts
Today, we received an invoice for one of our expenses. To send the payment, I logged into Bank of America's website to use their ACH (Automated Clearing
8160
