3721
Analyzing and breaking an externally encrypted HDD
Analyzing and breaking external encrypted HDD has been a “hobby” of mine for quite some time. With my colleagues Joffrey Czarny and Julien Lenoir we looked at several models in the past :
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,337 posts.
3722
Releasing jsfunfuzz and DOMFuzz
Today I'm releasing two fuzzers: jsfunfuzz , which tests JavaScript engines, and DOMFuzz , which tests layout and DOM APIs.
3723
0x01 – Killing Windows Kernel Mitigations
This post was made possible through hard work and determination. Do not feel frustrated if this stuff does not click immediately and remember, the source of truth will always be the source code. For us, our source code is raw assembly. That said it’s important you understand these techniques in detail because when…
3724
Facebook paid $4.5K for disclosure of my user account exploit
Back in 2009 I found a major security exploit on both Facebook and the than popular MySpace which exposed access to a user's personal data. I reported both data leaks to the social networks, and…
3725
I fear for the unauthenticated web
LLM and AI companies seem to all be in a race to breathe the last breath of air in every room they stumble into. This practice started with larger websites, ones that already had protection from ma...
3726
Another Conflict Between Privacy Laws and Age Authentication–Murphy v Confirm ID
This opinion is a routine ruling over TOS formation and whether disputes must go to arbitration. However, before I dig into that question, I need to note the case’s chilling implications. * * * This case involves the Adult Friend...
3727
3728
Time-lock encryption
How do you encrypt a file such that it can be decrypted after a date, but not before? Use serial computations for proof-of-work using successive squaring, chained hashes, or witness encryption on blockchains.
3729
Chrome client “variations” can be used to identify you (2020)
Until now I used Chrome with a few settings tweak like disabling sending usage statistics, uBlock origin, no crash reports and so on.
3730
What's the risk from fake Yubikeys?
I found this on a security-related Slack (shared with permission). It launched an entertaining discussion about the risks of taking a potentially fake FIDO token. We all know the risks of taking a free USB drive and shoving it in our computer, right? USB sticks can install software, act as a keylogger, transmit data…
3731
Body found in Canada identified as neo-nazi spam king
The body of a man found shot inside a burned out vehicle in Canada three years ago has been identified as that of Davis Wolfgang Hawke , a prolific spammer and neo-Nazi who led a failed anti-government march on Washington, D.C. in 1999, according to news reports.
3732
Who Does Skype Let Spy?
Lately I’ve been thinking a lot about power and the Internet, and what I call the feudal model of IT security that is becoming more and more pervasive. Basically, between cloud services and locked-down end-user devices, we have less control and visibility over our security—and have no point but to trust those in power…
3733
Tarsnap exploit bounty
Most bugs are straightforward, but occasionally one comes up which is not so clear in its impact. Such is the case with a bug which is fixed in tarsnap 1.0.36 . This bug causes the NUL string termination byte to overflow the heap-allocated buffer used for paths of objects examined as tarsnap traverses a directory…
3734
3735
Breaking 256-Bit Elliptic Curve Encryption with a Quantum Computer
Researchers have calculated the quantum computer size necessary to break 256-bit elliptic curve public-key cryptography: Finally, we calculate the number of physical qubits required to break the 256-bit elliptic curve encryption of keys in the Bitcoin network within the small available time frame in which it would…
3736
3737
Converting untrusted PDFs into trusted ones: The Qubes Way (2013)
Arguably one of the biggest challenges for desktop security is how to handle those overly complex PDFs, DOCs, and similar files, that are so often exchange...
3738
3739
Deterministic Quoting: Making LLMs safer for healthcare
LLMs have the potential to revolutionise our field of healthcare, but the fear and reality of hallucinations prevent adoption in most applications.
3740
Account hijacking on MtGox
If it wasn't MtGox I wouldn't even mention it — XSS/fixation/etc are web sec routines, and are not worth a blog post. But it *is* MtGox. W...
3741
3742
Characterizing secret leakage in public GitHub repositories
How bad can it git? Characterizing secret leakage in public GitHub repositories Meli et al., NDSS’19 On the one hand you might say there’s no new news here. We know that developers shouldn’t …
3743
The Orphaned Internet – Taking Over 120K Domains via a DNS Vulnerability
A Hacker's Blog of Unintended Use and Insomnia.
3744
3745
3746
Write your passwords down
Here's my advice on password security based on the collected opinions of others: 1. Write them down and keep them in your wallet because you...
3747
Security Risks of TSA PreCheck
Former TSA Administrator Kip Hawley wrote an op-ed pointing out the security vulnerabilities in the TSA’s PreCheck program: The first vulnerability in the system is its enrollment process, which seeks to verify an applicant’s identity. We know verification is a challenge: A 2011 Government Accountability Office report…
3748
How my brother's iCloud account was stolen
My brother got his iPhone stolen at gunpoint. This is the story of how he lost control of his iCloud account first (along with years of priceless memories, including my nephew's first steps) and how this couldn't have happened without Apple's incompetent support.
3749
Software Security Is a Programming Languages Issue (2018)
Software security must be addressed by all programmers, not just security experts. So we teach it in CS 330, a programming (languages) class.
3750
LastPass’ Authenticator app is not secure
An easy, root-free way to bypass fingerprint protection on LastPass’ authenticator app