91
92
China listening in on Skype - Microsoft assumes you approve
Fighting censorship with technology since 2011. We use AI to monitor censorship and expand free speech worldwide.
93
Linux Local Privilege Escalation via SUID /proc/pid/mem Write
Introducing Mempodipper , an exploit for CVE-2012-0056. /proc/ pid /mem is an interface for reading and writing, directly, process memory by seeking around with the same addresses as the process's virtual memory space. In 2.6.39, the protections against unauthorized access to /proc/ pid /mem were deemed sufficient…
94
Chromium Blog: A Tale Of Two Pwnies (Part 2)
When we wrapped up our recent Pwnium event, we praised the creativity of the submissions and resolved to provide write-ups on how the two e...
95
96
97
98
The Critical Security Flaws that Resulted in Last Friday's Hack
A core value CloudFlare is that security information should be shared between organizations to make the entire Internet safer. That is how CloudFlare's systems work: if one site is attacked, data about that attack is immediately shared with the rest of the network so other sites can be safe.
99
100
#1 CSRF Is A Vulnerability In All Browsers
Navigation: #1 CSRF Is A Vulnerability In All Browsers - You MUST Deny It ASAP. #2 top secret(will be published on April 1) #3 Another Ra...
101
102
Mozilla blogger bought 1 million Facebook entries (full name, e-mail) for $5
I have the bloody habit to look for cheap deals on some websites and today I’ve got the featured offer to buy more than 1 million Facebook entries containing Full Name, e-mail and Facebook profile URL. I make a quick check over the data and surprise, surprise: most of them are real and I even know some of those users.
103
Scamming the scammers – catching the virus call centre scammers red-handed
A few months back I got a call one evening which was clearly a virus call centre scam; you know, the ones that call you out of the blue, tell you your PC is infected with all sorts of nasties and offer to fix it for you? Or maybe you
104
Petition the U.S. Government to Force the TSA to Follow the Law
This is important: In July 2011, a federal appeals court ruled that the Transportation Security Administration had to conduct a notice-and-comment rulemaking on its policy of using “Advanced Imaging Technology” for primary screening at airports. TSA was supposed to publish the policy in the Federal Register, take…
105
Don't use bcrypt
(Edit: Some numbers for you people who like numbers) If you're already using bcrypt, relax, you're fine, probably. However, if you're ...
106
107
108
109
If malware authors ever learn how to spell we're all screwed
Forgive the lousy screenshot and transparency in the title bar, but I just got ...
110
Did NSA Put a Secret Backdoor in New Encryption Standard? (2007)
Random numbers are critical for cryptography: for encryption keys, random authentication challenges, initialization vectors, nonces, key-agreement schemes, generating prime numbers and so on. Break the random-number generator, and most of the time you break the entire security system. Which is why you should worry…
111
Master Keys
Earlier this month, a retired New York City locksmith was selling a set of “master keys” on eBay: Three of the five are standard issue for members of the FDNY, and the set had a metal dog tag that was embossed with an FDNY lieutenant’s shield number, 6896. The keys include the all-purpose “1620,” a master firefighter…
112
113
Why you should never use hash functions for message authentication
The general thrust of this post is: use a MAC function like HMAC to sign data, don’t use hash functions. Although not all hash functions suffer from the problem I’m going to illustrate, in general using a hash function for message authentication comes with a lot of potential problems because those functions aren’t…
114
Format string vulnerability found in 'sudo'
A flaw exists in the debugging code in sudo versions 1.8.0 through 1.8.3p1 that can be used to crash sudo or potentially allow an unauthorized user to elevate privileges. Sudo versions affected: 1.8.0 through 1.8.3p1 inclusive. Older versions of sudo are not affected. CVE ID: This vulnerability has been assigned…
115
Vulnerabilities in Heroku's Build System
Last week I discovered a major security flaw in the Heroku Cedar stack build. This vulnerability exposed sensitive information including API keys, private keys and server credentials.
116
Vice.com Reveals John McAfee's Location In iPhone Metadata
Some time ago, the website Vice.com posted an article with the somewhat full of themselves title “We Are With John McAfee Right Now, Suckers”. In it, they reveal how they have been traveling with John for the better part of the week.
117
Members of Congress Demand Answers for the Unjust Domain Name Seizures
This morning, a bipartisan group of Representatives, led by Rep. Zoe Lofgren (D-Calif.), sent a pointed letter to Attorney General Eric Holder and the Secretary of Homeland Security Janet Napolitano protesting the recent spat of domain name seizures—executed on dubious copyright grounds—that have...
118
When Will We See Collisions for SHA-1?
On a NIST-sponsored hash function mailing list, Jesse Walker (from Intel; also a member of the Skein team) did some back-of-the-envelope calculations to estimate how long it will be before we see a practical collision attack against SHA-1. I’m reprinting his analysis here, so it reaches a broader audience. According…
119
120
Sexual Harassment at DefCon (and Other Hacker Cons)
Excellent blog post by Valerie Aurora about sexual harassment at the DefCon hackers conference. Aside from the fact that this is utterly reprehensible behavior by the perpetrators involved, this is a real problem for our community. The response of “this is just what hacker culture is, and changing it will destroy…