391
Major Remote SSH Security Issue in CoreOS Linux Alpha
No single cloud fits all. Explore how we build a more flexible future with hybrid cloud.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 578 posts.
392
Widespread XSS Vulnerabilities in Ad Network Code
For most of us, the title of this post may not be very surprising. Any time we allow 3rd party scripts to run on our sites, we effectively relinquish control of the code that executes on the client. This is particularly important when integrating ad network scripts since they are inherently more dynamic than most…
393
CloudFlare, SSL and unhealthy security absolutism
Let's start with a quick quiz: Take a look at haveibeenpwned.com [https://haveibeenpwned.com/] (HIBP) and tell me where the traffic is encrypted between: You see HTTPS which is good so you know it's doing crypto things in your browser, but where's the other end of
394
The State of Linux Security
This is the state of Linux security. With the most important updates around Linux and open source security. From conferences to self-protection.
395
Obama Has Gotten 3,000+ Tweets about Encryption. Let’s Double That
EFF, ACLU, and Access Now released a statement in support of Apple and its stance on encryption last week. We called on the President to reject any attempt to force backdoors like the one the FBI was seeking to Apple’s operating system. We asked our communities to help by tweeting at the President...
396
RubyGems.org gem replacement security vulnerability and mitigation
Summary RubyGems.org contained a bug that could allow an attacker to replace some .gem files on our servers with a different file that they supplied. We deployed a partial fix on April 2nd and a co...
397
398
Dissecting a spammer's spam script
Let's dissect a PHP spam script and find out how spammers send spam messages and how they have tried to obfuscate the actual code they use.
399
Controlling vehicle features of Nissan LEAFs remotely via vulnerable APIs
Last month I was over in Norway doing training for ProgramUtvikling, [http://programutvikling.no/] the good folks who run the NDC conferences I've become so attached to. I was running my usual “Hack Yourself First” workshop [https://www.troyhunt.com/2016/02/more-europe-even-more-again-and-more.
400
401
HTTPS Adoption doubled this year
Despite having been around for over 20 years, HTTPS always remained very lightly adopted – until 2016. Data from two independent sources shows that HTTPS adoption more than doubled from 2015 to 2016. Snyk CEO Guy Podjarny digs into this data.
402
Advanced Deanonymization Attacks
News posted by Whonix staff. The Whonix Blog. Stay Tuned. (rss)
403
Configuring a High Interactivity SSH HoneyPot
Due to continued visitation resulting in 404s to this article it has been restored from an older, and lost, version of this blog from content at – https://web.archive.org/web/20170811222717/https://www.robertputt.co.uk/2016/11/28/learn-from-your-attackers-ssh-honeypot/ , it may be incomplete, for example images being…
404
Learning Exploitation with Offensive Computer Security 2.0
Own this domain today. We make your shopping experience easy. Friendly and quick customer service.
405
Zero Knowledge Proofs: An illustrated primer (2014)
One of the best things about modern cryptography is the beautiful terminology. You could start any number of punk bands (or Tumblrs) named after cryptography terms like ‘hard-core predicate&#…
406
Bitbucket secrets
Research, expert perspectives, and product announcements from Atlassian on how teams can work smarter with AI. Subscribe for monthly insights on the future of teamwork.
407
Analyzing the Patterns of Numbers in 10M Passwords (2015)
There are many patterns for numbers in passwords, which involve surprising yet intuitive logic.
408
A year of Windows kernel font fuzzing #1: the results
Posted by Mateusz Jurczyk of Google Project ZeroThis post series is about how we used at-scale fu...
409
An exploit kit hiding in the pixels of malicious ads
Millions of readers who visit popular news websites have been targeted by a series of malicious ads redirecting them to the Stegano exploit kit.
410
OpenSSL CVE-2016-0799: heap corruption via BIO_printf
There are a couple of issues with OpenSSL’s BIO_*printf() functions, defined in crypto/bio/b_print.c, that are set to be fixed in the forthcoming security release. The function that is primar…
411
SELinux is beyond saving
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
412
Reversing Go Binaries Like a Pro
GO binaries are weird, or at least, that is where this all started out. While delving into some Linux malware named Rex, I came to the realization that I might need to understand more than I wanted to
413
414
Improved Authentication for Email Encryption and Security
Today, we are happy to become the first and only secure email service to support Secure Remote Password (SRP), a much more secure authentication method.
415
Finland: New surveillance law threatens fundamental rights (2015)
Finnish EDRi member Electronic Frontier Finland (Effi) is gravely concerned over a draft law on Internet surveillance. The bill that the country’s current government is in the process of preparing will grant the military and the Finnish Security Intelligence Service (Supo) the authority to conduct electronic mass…
416
On WebKit Security Updates
Linux distributions have a problem with WebKit security. Major desktop browsers push automatic security updates directly to users on a regular basis, so most users don't have to worry about security updates. But Linux users are dependent on their distributions to release updates. Apple fixed over 100 vulnerabilities…
417
418
Advanced Tor Browser Fingerprinting
The ability to privately communicate through the internet is very important for dissidents living under authoritary regimes, activists and basically everyone concerned about internet privacy.
419
Tails installer is now in Debian
Tails (The amnesic incognito live system) is a live OS based on Debian GNU/Linux which aims at preserving the user's privacy and anonymity by using the Internet anonymously and circumventing censorship. Installed on a USB device, it is configured...
420
The Difficulty of Private Contact Discovery
Building a social network is not easy. Social networks have value proportional to their size, so participants aren’t motivated to join new social networks which aren’t already large. It’s a paradox where if people haven’t already joined, people aren’t motivated to join. The trouble is that whi...