31
32
33
Tracking Down a Stolen iPhone
( Note: some screenshots are quite obviously simulated. ) ( Note 2: this is my first blog post in over three years, feel free to read my ancient history if you like. ) ( Note 3: All said and done, the comments and Internet-fame have been awesome. I'm moving on though. If you're interested, check…
34
35
36
37
38
Stop Password Masking
Usability suffers when users type in passwords and the only feedback they get is a row of bullets. Typically, masking passwords doesn't even increase security, but it does cost you business due to login failures.
39
Faking votes on Hacker News
Hacker News is a site where users vote on links. When someone clicks on an up or down vote, their browser sends a GET request that looks like this: GET /vote?by= joesmith dir=upfor=8765309 A user can only vote if the by parameter matches their Hacker News login cookie. So for a third…
40
41
Encrypt-then-MAC
First things first: Why use a composition of encryption and MAC instead of a single primitive which achieves both? Because people are very good at writing bad code. In my experience on the FreeBSD security team, writing dozens of security advisories, there are three types of code which are especially prone to have…
42
Creative anti-debugger technique in Spotify for Windows
Spotify for Windows contains code so awesome that OllyDbg can't look at it without crashing.
43
44
Twitter Exploit Still Works
I bet 10 years ago none of us thought that 140 characters would change the landscape of Social Media quite so much. However, with close to 289,000,000 active users sending around 6,000 tweets every second Twitter has proven its critics wrong. Obviously, having gotten over …
45
Corrupted Word Files for Sale
On one hand, this is clever: We offer a wide array of corrupted Word files that are guaranteed not to open on a Mac or PC. A corrupted file is a file that contains scrambled and unrecoverable data due to hardware or software failure. Files may become corrupted when something goes wrong while a file is being saved e.g…
46
Palm Pre Privacy Invasion
I've been taking a closer look at the WebOS side of my Palm Pre tonight, and I noticed that it periodically uploads information to Palm, Inc.
47
Nate Lawson Breaks Google Keyczar's HMAC Crypto Signatures
I recently found a security flaw in the Google Keyczar crypto library. The impact was that an attacker could forge signatures for data that was “signed” with the SHA-1 HMAC algorithm (t…
48
How Credit Card Numbers Are Generated
Visa,Master Card,Discover, and American Express credit card validation and generation techniques using the luhn algorithm.
49
Datacenter Security: A Cautionary Tale from Last.fm
Last.fm has presence in three datacenters in the London area - this is currently more because of necessity than redundancy; datacenter space is at a real premium in the UK and we can’t fulfill our power growth needs at just one site. We operate our own 20 gigabit fibre ring between these, which means we can basically…
50
"Goldman sachs code torrent" honeypot
.rar 32MB. A distributed real-time co-located high-frequency trading platform… A very low latency (microseconds) event-driven market data processing, strategy and order submission engine.
51
52
Complexity is insecurity
Complexity can be thought of as a type of code smell : It doesn't necessarily imply that there is a problem, but the presence of complexity is very strongly correlated with the presence of security vulnerabilities. In the design and construction of secure systems, it is important to not only consider mistakes which…
53
54
Media Temple Hacked
I don’t normally do negative posts about another person or company, but I feel this needs to get out there. A few hours ago I received an email from MediaTemple , where I host several of my clients. It was an automated message informing me that:
55
56
New iPhone app piracy over week one.
If you know your way around a professional writers' room, you know how to use WritersRoom Pro ®
57
Virtual Mafia in Online Worlds
If you allow players in an online world to penalize each other, you open the door to extortion: One of the features that supported user socialization in the game was the ability to declare that another user was a trusted friend. The feature involved a graphical display that showed the faces of users who had declared…
58
59
H(m || k) also insecure, you really should use HMAC
The HMAC construction turns a cryptographic hash algorithm into a keyed hash. It is commonly used for integrity protection when the sender and recipient share a secret key. It was developed to addr…
60