151
Searching for "semicolon injection" bugs in embedded Linux devices
Introduction I recently bought a D-Link DCS-2121 surveillance camera. This is good stuff: Megapixel camera + microphone + speaker WiFi,...
152
MySQL.com currently Hacked (and serving javascript malware)
It looks like the MySQL.com website is currently hacked and compromised with a JavaScript malware (and serving malware to anyone visiting it). Our scanner identified…
153
DOM Snitch: Google's passive in-the-browser reconnaissance tool
By Radoslav Vasilev from Google Zurich Every day modern web applications are becoming increasingly sophisticated, and as their complexity ...
154
155
156
EFF: Some Facts About Carrier IQ
There has been a rolling scandal about the Carrier IQ software installed by cell phone companies on 150 million phones, mostly within the United States. Subjects of outright disagreement have included the nature of the program, what information it actually collects, and under what circumstances....
157
158
159
Hacking Twitter's Javascript
New Twitter uses a massive amount of javascript (for a webapp). Nearly 1 Megabyte of minified, obfuscated javascript powers the site's frontend.
160
I’m sorry, but were you actually trying to remember your comical passwords?
I love a good XKCD comic; Randall Munroe has a unique way of cutting right to the crux of technology issues and always doing it in a humorous fashion. Little Bobby Tables [http://xkcd.com/327/] remains an all-time classic and it’s amazing how many times you’ll
161
162
163
164
165
Iranian hackers obtain fraudulent HTTPS certificates
On March 15th, an HTTPS/TLS Certificate Authority (CA) was tricked into issuing fraudulent certificates that posed a dire risk to Internet security. Based on currently available information, the incident got close to — but was not quite — an Internet-wide security meltdown. As this post will...
166
167
Yet Another "People Plug in Strange USB Sticks" Story
I’m really getting tired of stories like this: Computer disks and USB sticks were dropped in parking lots of government buildings and private contractors, and 60% of the people who picked them up plugged the devices into office computers. And if the drive or CD had an official logo on it, 90% were installed. Of course…
168
What Location Tracking Looks Like
Your cell phone company knows everywhere you go, twenty-four hours a day, every day. How concrete is this fact for you? It's very concrete for Malte Spitz, a German politician and privacy advocate. He used German privacy law — which, like the law of many European countries, gives individuals a...
169
170
FBI chastened by court for lying about existence of surveillance records
An order from the U.S. District Court for the Central District of California has revealed the FBI lied to the court about the existence of records requested under the Freedom of Information Act (FOIA), taking the position that FOIA allows it to withhold information from the court whenever it thinks...
171
Do not upgrade to PHP 5.3.7 due to a bug in crypt()
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
172
173
174
1 Database Containing 35,000,000 Google Profiles. Implications?
UPDATE 2012-02-16: raver1975 released a SQL database w/35M Google Profiles as .torrent on The Pirate Bay. UPDATE 2011-06-10: Central question in the Google discussion is whether mass-aggregation of profile data…
175
176
177
How Dropbox sacrifices user privacy for cost savings
Note: This flaw is different than the authentication flaw in Dropbox that Derek Newton recently published . Summary Dropbox , the popular cl...
178
UTorrent.com compromised, malware added to installer
This morning on 9/13/2011 at approximately 4:20 a.m. Pacific Daylight Time (UTC -7), the uTorrent.com and BitTorrent.com Web servers were compromised. Our standard Windows software download was replaced with a type of fake antivirus “scareware” program. (UPDATE: See below for removal instructions.) Just…
179
De-anonymizing Apple UDIDs with OpenFeint
Every iPhone, iPad and iPod touch has an associated Unique Device Identifier (UDID). You can think of the UDID as a serial number burned into the device - one that can't be removed or changed 1 . This number is exposed to app developers through an API, without requiring the device owner's permission or knowledge.
180
Bittorrent over Tor isn't a good idea
An increasing number of people are asking us about the recent paper coming out of Inria in...