361
362
363
364
Open Letter From UK Security Researchers
Dear Reader, The first set of publications based on Edward Snowden’s files were concerned with surveillance of internet communication h...
365
Android Bug Superior to Master Key
Assuming you enjoy this article, I encourage you to read the next one in the series: Yet Another Android Master Key Bug .
366
Liberty Reserve Founder Arrested, Site Shuttered
The founder of Liberty Reserve , a digital currency that has evolved as perhaps the most popular form of payment in the cybercrime underground, was reportedly arrested in Spain this week on suspicion of money laundering. News of the law enforcement action may help explain an ongoing three-day outage at…
367
368
Achilles Heel of OAuth or Why Facebook Adds #_=_
This is a short addition to the previous rants on OAuth problems. We've got Nir Goldshlager working on our side (he simply loves bounties...
369
TRESOR Runs Encryption Securely Outside RAM
TRESOR is a secure implementation of AES which is resistant against cold boot attacks. The basic idea behind this implementation is to store the secret key inside CPU registers rather than in RAM.
370
A Really Good Article on How Easy it Is to Crack Passwords
Ars Technica gave three experts a 16,000-entry encrypted password file, and asked them to break them. The winner got 90% of them, the loser 62%—in a few hours. The list of “plains,” as many crackers refer to deciphered hashes, contains the usual list of commonly used passcodes that are found in virtually every breach…
371
372
373
Exploiting a Go Binary
Earlier this year, tylerni7 showed us a proof of concept for a 32 bit Go exploit using this issue . geohot and I had a wager over who could get the first remote code execution on play.golang.org : he won, but just barely ;-). Props also to ricky for helping to find the underlying cause/writing the patch. Here is a…
374
Browser Extension Password Managers Exposing Passwords Everywhere
Advancements in password cracking and frequent theft of password databases endanger single-factor password authentication systems. Password managers are one of the only tools available that can help users remember unique high-entropy passwords, and other secrets such as credit card numbers, for a large number of…
375
Two-Factor Authentication and the Police State
In Britain - and many other countries - the police can legally force you to divulge your passwords. Whether it's to an encrypted file, a social network, or your email account, the state can legally rifle through your most intimate thoughts and (potentially) pose as you online. As we've recently seen, this can be done…
376
377
378
IDIV DoS (INT_MIN / -1)
A little fun for the last day of 2012: how to crash a program via division? x86’s IDIV instruction traps not only on division by zero, but also on INT_MIN / -1 (signed integer overflow).
379
How to botch TLS forward secrecy
There's been some discussion about forward secret TLS recently, spurred, I think, by this piece from Declan McCullagh on CNET.
380
Keeping Passwords in Source Control
I learned a neat tip from my co-worker, Craig Silverstein ( more on Craig joining Khan Academy ), recently and I thought others might find it to be useful.
381
382
Faking Bluetooth LE
Dmitry.GR: Creating BTLE-compliant advertisement packets, so that iOS and android devices can see and parse them.
383
XSS in Gmail through Rapportive
A blog on security, malware, cryptography, pentesting, javascript, php and whatnots
384
385
Is Unicode Safe?
Unicode is just too complex to ever be secure.  — Bruce Schneier, 2000 Over the last 25 years Unicode has succeeded. It hasn't displaced all other character encodings, but it's clearly on its way there. It's supported widely enough that it's a compatible choice, new projects use it, and it's becoming the…
386
387
388
389
Snapchat - GibSec Full Disclosure
A series of nicely formatted documents about Snapchat by GibSec.
390
NBC.com hacked, serving up Citadel malware
A few hours ago Ronald Prins of Fox-IT (@cryptoron) was tweeting about NBC.com infecting its visitors with malicious software (malware). We were investigating this as well and found the following i…