121
122
123
You are committing a crime right now (2012)
Are you reading this blog? If so, you are committing a crime under 18 USC 1030(a) (better known as the “ Computer Fraud & Abus...
124
How likely is the NSA PRISM program to catch a terrorist?
Recent revelations about PRISM, the NSA’s massive program of surveillance of civilian communications have caused quite a stir. And rightfully so, as it appears that the agency has been grante…
125
Where “nothing to hide” fails as logic
Every April, I try to wade through mounds of paperwork to file my taxes. Like most Americans, I’m trying to follow the law and pay all of the taxes that I owe without getting screwed in the process. I try and make sure that every donation I made is backed by proof, every deduction is backed by logic and documentation…
126
PRISM? Come to Israel to study our surveillance state
It seems that those who were astonished, abhorred, enraged or outraged from finding out that the National Security Agency (NSA) tracked millions of united states citizens and did so with the cooperation of numerous internet service providers, telecommunication companies and web-based hosting services had not even…
127
Complete, Persistent Compromise of Netgear Wireless Routers
UPDATE: Turns out, Jacob Holocomb ( @rootHak42 on Twitter) of Independent Security Evaluators found this bug back in April on a different d...
128
Securing Ubuntu
Table of Contents Initial Setup Setting up iptables and Fail2Ban Fail2Ban iptables rules Make shared memory read-only Setting up Bastille Linux Configuring Bastille sysctl hardening Setting up a chroot environment Securing nginx inside the chroot Extras Initial Setup Let’s login to our new machine and take some…
129
130
Can Apple read your iMessages?
About a year ago I wrote a short post urging Apple to publish the technical details of iMessage encryption. I’d love tell you that Apple saw my influential crypto blogging and fell all over t…
131
Hacking the OS X Kernel for Fun and Profiles
My last post described how user-level CPU profilers work, and specifically how Google’s pprof profiler gathers its CPU profiles with the help of the operating system. The specific feature needed from the operating system is the profiling timer provided by setitimer (2) and the SIGPROF signals that it delivers.
132
How I attacked a fellow student
I’m a college student studying abroad at the University of Pennsylvania, studying a mixture of CS, Physics and Music. This semester I decided to take a course CIS551: Network and Computer Security, eager to learn about the field. This is the story of how as part of the course, I compromised the security of one […]
133
Exploiting a Bug in Google's Glass
A few days ago, I posted to Twitter a picture I took of a Google Glass unit running software that I had modified. I did this while in the Bay Area after picking it up from Google's headquarters in Mountain View. I was unable to provide many more details at the time, as I first was busy driving home, and then became…
134
Bitcoin as a law enforcement/natsec honeypot: what is the evidence?
Paranoia appears to be the order of the day, given what we know about the NSA and GCHQ thanks to Edward Snowden. Absent from the stories so...
135
How to send DMs on Twitter without permission
I just recalled " SMS commands " feature and tried to send a DM (private, direct message) with "Share on Twitter"-button. It works! Twitt...
136
Node.js incorrectly parses HTTP methods
One who writes code
137
Here come the encryption apps
It seems like these days I can’t eat breakfast without reading about some new encryption app that will (supposedly) revolutionize our communications — while making tyrannical regimes fa…
138
The Fallacy of Cracking Contests (1998)
In this issue: The Fallacy of Cracking Contests How to Recognize Plaintext News The Doghouse: Iomega Zip Disks Counterpane Systems News Final Report from the Commerce Department Technical Advisory Committee on Key Recovery Comments From Readers About "CRYPTO-GRAM"
139
Dear Mozilla, stop watching me
I have signed the StopWatching.Us letter today. I am not a US citizen, so even if the letter succeeds, I don’t think my privacy will improve substantially. But at least I did something.
140
141
Snowden's Dead Man's Switch
Edward Snowden has set up a dead man’s switch. He’s distributed encrypted copies of his document trove to various people, and has set up some sort of automatic system to distribute the key, should something happen to him. Dead man’s switches have a long history, both for safety (the machinery automatically stops if…
142
On Python security amidst recent Rails/YAML vulnerabilities
The Rails community has had a few high-profile security issues this week. They are well-summarized, with an alarming list of what follow-ons to expect, by Patrick McKenzie: What the Rails Security Issue Means for Your Startup.
143
144
145
146
147
148
149
Smartphone can use its microphone to extract RSA decryption key from laptop
This is neat: Here, we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG’s current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of…
150
Tiny, cheap, and dangerous: Inside a fake iPhone charger
Thoughts on the death of Ma Ailun According to reports , a woman in China was tragically electrocuted using her iPhone while it was char...