121
122
123
124
On CPU backdoors - Trusting hardware
So, you're a decent paranoid person, running only open source software on your box: Linux, GNU, etc. You have the feeling you could, if you ...
125
The Most Incompetent TSA Story Yet?
The storyline: TSA screener finds two pipes in passenger’s bags. Screener determines that they’re not a threat. Screener confiscates them anyway, because of their “material and appearance.” Because they’re not actually a threat, screener leaves them at the checkpoint. Everyone forgets about them. Six hours later, the…
126
SSH Do’s and Don’ts
Do Use SSH Keys When ever you can use a key for SSH. Once you create it, you can distribute the public side widely to enable access where ever you need it. Generating one is easy: ssh-keygen -t dsa Don't Use a Blank Passphrase on Your Key This key is now your identity. Protect it.
127
Bitsquatting: DNS Hijacking without exploitation
Researchers have exploited bit-errors before in amazing ways . But bit-errors can be detected and exploited in new ways on an Internet-wide scale. One of these means is by bitsquatting, or registering domain names one bit different than frequently resolved domains.
128
Olympics 2012: A Bruce Schneier Moment
An east London estate, where 700 people live, has received leaflets saying a "Higher Velocity Missile system" could be placed on a water tower. ...
129
130
131
SSH key and passwordless login basics for developers
SSH keys are useful to login over ssh (secure shell) without typing a password. They are also used by Github and other version control systems for passwordless authentication. Here is some basic information from the software developer point of view how to use SSH keys for maximum comfort and security. These…
132
133
One way to fix your rubbish password database
Suppose for a moment that you are running a web site that has a poorly implemented password database that stores password hashes using some...
134
135
136
Countering "Trusting Trust"
Way back in 1974, Paul Karger and Roger Schell discovered a devastating attack against computer systems. Ken Thompson described it in his classic 1984 speech, “Reflections on Trusting Trust.” Basically, an attacker changes a compiler binary to produce malicious versions of some programs, INCLUDING ITSELF. Once this is…
137
ImperialViolet
When a browser connects to an HTTPS site it receives signed certificates which allow it to verify that it's really connecting to the domain that it should be connecting to. In those certificates are pointers to services, run by the Certificate Authorities (CAs) that issued the certificate, that allow the browser to…
138
The Doghouse: Crypteto
Crypteto has a 49,152-bit symmetric key: The most important issue of any encryption product is the ‘bit key strength’. To date the strongest known algorithm has a 448-bit key. Crypteto now offers a 49,152-bit key. This means that for every extra 1 bit increase that Crypteto has over its competition makes it 100%…
139
Random Number Bug in Debian Linux
This is a big deal: On May 13th, 2008 the Debian project announced that Luciano Bello found an interesting vulnerability in the OpenSSL package they were distributing. The bug in question was caused by the removal of the following line of code from md_rand.c MD_Update(&m,buf,j); [ .. ] MD_Update(&m,buf,j); /* purify…