151
How Heartbleed could've been found
This blog is written by Hanno Böck. Unless noted otherwise, its content is licensed as CC0 .
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 213 posts.
152
153
Magento eCommerce PHP Remote Code Execution
Critical remote code execution vulnerability in Magento (SUPEE-5344). Patch immediately. Affects 200,000 stores. Includes patch download and analysis.
154
155
156
Safe Native Code
Joe Duffy's Blog | Adventures in the high-tech underbelly
157
Tarsnap email confirmation bypass
One consequence of these unsolicited security scans is that — since they feed a variety of inputs to forms, including the account creation form — I see a lot of obviously fake signup attempts (alas, none yet from the world's most obviously fake domain name ). These are harmless, since the signup code sends out a…
158
159
160
The Web Authentication Arms Race – A Tale of Two Security Experts
Web authentication systems have evolved over the past ten years to counter a growing variety of threats. This post will present a fictional arms race between a web application developer and an attacker, showing how different threats can be countered with the latest security technologies.
161
The End of Safe Harbor and a Scary Path Forward
Some in detail analysis about what the end of safe harbor means for small companies, especially in Europe.
162
OAuth1, OAuth2, OAuth..? (2013)
TL;DR OAuth2 sucks. Please don't think about OAuth2 as about the next generation of OAuth1. They are completely different like colors: O...
163
164
Komodia SSL certificates are in many products
So, as people have started turning over stones, looking to see how common these Komodia certificates are, some surprising (and depressing) things are beginning to surface. It does appear that Komod…
165
The Most Dangerous Code in the Web Browser
Personal website of Stefan Heule
166
Telegram stalking
Update 20151216: This quick post got far more attention than expected. I regret not mentioning that the leakage can easily be prevented via a setting. In practice the problem remains, users in general will have no idea about this being a relevant setting to change and will stay with the default. The best discussion on…
167
Volkswagen and Cheating Software
Portuguese translation by Ricardo R Hashimoto For the past six years, Volkswagen has been cheating on the emissions testing for its diesel cars. The cars’ computers were able to detect when they were being tested, and temporarily alter how their engines worked so they looked much cleaner than they actually were. When…
168
Why FPGA manufacturers keep their bitstream formats secret
Every FPGA vendor keeps the bitstream format for their device secret. Only the tools provided in binary-only format by the vendor (and a select few third parties under NDA) can generate these bitstreams.
169
170
Shellcode Injection
Injecting shellcode by overflowing the buffer - Demonstration
171
UUIDs generally do not meet security requirements
Some time ago, I was doing a web application penetration test, and noticed that the authentication tokens were UUIDs. This I knew was risky, and in fact if you read the UUID rfc, section 6 of it wa…
172
The OpenSSH Bug That Wasn't
Much has been written about a purported OpenSSH vulnerability. On closer inspection, the reports actually got most of their facts wrong. Rea...
173
A dead man's switch for your computer?
In the last few weeks, a lot of details have been disclosed around Ross Ulbricht’s arrest. For those not familiar with the matter, Ulbricht was arrested at …
174
Exploiting the Superfish certificate
As discussed in my previous blogpost, it took about 3 hours to reverse engineer the Lenovo/Superfish certificate and crack the password. In...
175
The lack of HTTPS at Amazon: identifying items purchased via information leakage
If you were to browse Amazon right now and someone was eavesdropping on your connection, they could tell exactly what you were looking at. They could even tell what you've bought.
176
AEADs: getting better at symmetric cryptography
I gave a talk a couple of weeks ago at the Yahoo Unconference . The conference was at the end of a particually hard week for a bunch of reasons and I fear that the talk wasn't that great. (Afterwards I got home about 3pm and pretty much slept until the following morning.) This post is a, hopefully clearer…
177
Breaking the Zyzzyva encryption
The article here sums up pretty well the debacle that North American tournament Scrabble players have been faced with since the…
178
Hacker Who Sent Me Heroin Faces Charges in U.S
A Ukrainian hacker who once hatched a plot to have heroin sent to my Virginia home and then alert police when the drugs arrived had his first appearance in a U.S. court today, after being extradited to the United States to face multiple cybercrime charges.
179
180