1
2
3
Creating a rogue CA certificate with MD5 hash collisions
We have identified a vulnerability in the Internet Public Key Infrastructure (PKI) used to issue digital certificates for secure websites. As a proof of concept we executed a practical attack scenario and successfully created a rogue Certification Authority (CA) certificate trusted by all common web browsers. This…
4
5
6
7
I've Seen the Future, and It Has a Kill Switch
It used to be that just the entertainment industries wanted to control your computers—and televisions and iPods and everything else—to ensure that you didn’t violate any copyright rules. But now everyone else wants to get their hooks into your gear. OnStar will soon include the ability for the police to shut off your…
8
9
Script kiddies have awesome tools
Wir ziehen mit dem Projekt ngra.de um. Sind Sie am Kauf der Domain ngra.de interessiert?
10
Bank Robber Recruits Accomplices With Fake Job Ad on Craigslist
Now this is clever: “I came across the ad that was for a prevailing wage job for $28.50 an hour,” said Mike, who saw a Craigslist ad last week looking for workers for a road maintenance project in Monroe. He said he inquired and was e-mailed back with instructions to meet near the Bank of America in Monroe at 11 a.m…
11
Io v. Veoh: Important ruling for sites comprised of 'user-generated content'
In an important ruling handed down yesterday, a federal district court threw out a copyright infringement suit brought by adult video producer Io Group against Veoh, concluding that the video hosting site qualifies for the DMCA safe harbor. The ruling should be required reading for the executives...
12
13
14
Three vulnerabilities every web application developer should know about
Here's another great lecture from Google Tech Talks. This lecture is given by Neil Daswani, who has a Ph.D. from Stanford and currently works at Google as a security engineer. He is also an author of a book titled "Foundations of Security: What Every Programmer Needs to Know", which teaches you state-of-the-art...
15
Schneier reviews: Here Comes Everybody
In 1937, Ronald Coase answered one of the most perplexing questions in economics: if markets are so great, why do organizations exist? Why don’t people just buy and sell their own services in a market instead? Coase, who won the 1991 Nobel Prize in Economics, answered the question by noting a market’s transaction…
16
Border Security: We can take your laptop anywhere we want for as long as we want
Amazing. The U.S. government has published its policy: they can take your laptop anywhere they want, for as long as they want, and share the information with anyone they want: Federal agents may take a traveler’s laptop or other electronic device to an off-site location for an unspecified period of time without any…
17
18
Tarsnap public beta
Tarsnap's paranoia also extends to the client-server protocol. With most online backup services, you're lucky if they use SSL; I avoided using SSL because I wasn't satisfied with its security. Obtaining a fraudulent SSL certificate is too easy (read: possible) for an attacker, and relying on external certification…
19
20
21
22
SHA-1 Broken
SHA-1 has been broken. Not a reduced-round version. Not a simplified version. The real thing. The research team of Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu (mostly from Shandong University in China) have been quietly circulating a paper describing their results: collisions in the the full SHA-1 in 2**69 hash…
23
My Open Wireless Network
Whenever I talk or write about my own security setup, the one thing that surprises people—and attracts the most criticism—is the fact that I run an open wireless network at home. There’s no password. There’s no encryption. Anyone with wireless capability who can see my network can use it to access the internet. To me…