The latest blog posts to take off on Hacker News. 473 posts.
In a recent paper, we showed that coding style is present in source code and can be used to de-anonymize programmers. But what if only compiled binaries are available, rather than source code? Today we are releasing a new paper showing that coding style can survive compilation. Consequently, we can utilize these…
The folks that build the NSIS Installer have released updates to mitigate a serious security bug related to DLL loading. (v2.5 and v3.0b3 include the fixes). To make a long and complicate…
Injecting shellcode by overflowing the buffer - Demonstration
Collection of my projects and hacks.
Last Friday, the TSA snuck out a document updating the “privacy policy” for the nude body scanners. On Tuesday, reports started coming in on the change, including right here. Professi…
Two months ago I have published a detailed survey of varioussecurity-related problems plaguing the Intel x86 platforms. While the picturepainted in the paper...
Learn about the features in NGINX and NGINX Plus that make them a valuable part of a solution for DDoS attack mitigation.
All too often, new police surveillance tools are initially applied to only the “worst of the worst” and then slowly—but surely—expanded to include an ever-growing number of less culpable individuals. We’ve seen it with DNA collection. And now we’re starting to see it with GPS tracking. That’s why...
It’s well known that SHA-1 is no longer considered a secure cryptographic hash function. Researchers now believe that finding a hash collision (two values that result in the same value when SHA-1 is applied) is inevitable and likely to happen.
A press conference was organised this morning on behalf of Mr Santa Claus. At the conference, a spokes–elf confirmed that there had been repeated attempts to hack the “naughty or nice (NON)” database. The NON-database was thought to be used by Mr Claus to keep records of young inhabitants of planet earth, in order to…
You might have heard that a few days ago, Juniper Systems announced the discovery of “unauthorized code” in the ScreenOS software that underlies the NetScreen line of devices. As a resu…
The most common questions we get from developers who already know their stuff
Joe Duffy's Blog | Adventures in the high-tech underbelly
Update : Ralf wrote up some notes from his work. These now include an update themselves with information from Willem Pinckaers that suggests that the presumed Dual-EC output is exposed to the world in Juniper devices.
We were disappointed today to learn that a federal appeals court in Pasadena declined to consider EFF’s appeal of a ruling in Jewel v. NSA, our long-running lawsuit battling unconstitutional mass surveillance of Internet and phone communications. While we are disappointed that government’s stall...
Security and Programming Blog
How participation in Facebook's bug bounty not only led to the complete compromise of Instagram, but also legal threats and intimidation
In the public battle for strong encryption, EFF has championed the voice of everyday Internet users. After all, if we can’t rely on the security of our digital communications, how can the Web continue to grow and thrive? Now the fight has moved to the Oval Office. EFF, Access Now, over a dozen...
Redpill Linpro Tech Blog
Digital analyzer. IMSI catcher. Stingray. Triggerfish. Dirt box. Cell-site simulator. The list of aliases used by the devices that masquerade as a cell phone tower, trick your phone into connecting with them, and suck up your data, seems to grow every day. But no matter what name cell-site...
What does the FBI want when it comes to the encryption “debate”? At an oversight hearing before the Senate Judiciary Committee today, FBI Director James Comey offered what he called the “good news” that it’s not a debate at all. In fact, he said, government and the tech industry all want the same...
