So it looks like Samsung is offline this morning . This shouldn't bother me - I don't work for them and their network isn't my problem. However it turns out that my Samsung Smart TV thinks there's no internet if there's no www.samsung.com :( - using tcpdump I started looking at what the TV was trying to contact when I…
I posted the following images the other day which although looking totally different have exactly the same MD5 hash ( e06723d4961a0a3f950e...
UPDATE #2: Apparently Samsung said in their press release that user should try out My Knox, as Knox Personal is deprecated. I just tried t...
German freemail heavyweights web.de and gmx.net (several millions of users combined) are using deceptive techniques in order to manipulate Firefox and Chrome users into removing AdBlock and its var…
Professor Steven J. Murdoch
iOS has hidden the pathname of URLs for some time now, but recently Chrome Canary introduced something similar behind a flag.
dfir.org is the personal page of Andrew Case ( @attrc ). This website serves as a central location for all of my research, software projects, and speaking events.
Public Key Pinning helps ensure that people are connecting to the sites they intend . Pinning allows site operators to specify which certif...
TL;DR Every website with "Connect Facebook account and log in with it" is vulnerable to account hijacking. Every website relying on signed_r...
DIN INFO IP Adresse ( IPv4 eller IPv6) 104.165.132.197 Port: 47376 Hostnavn: 104.165.132.197 X-Forward IP Adresse(r): Browser (UserAgent): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Forespørgsels Timestamp (Unix tid): 1793882617 Forespørgsels…
The other day I wrote an article discussing LibreSSL , and the common mistakes being made by those thinking they know how to port it to oth...
One of the best things about modern cryptography is the beautiful terminology. You could start any number of punk bands (or Tumblrs) named after cryptography terms like ‘hard-core predicate&#…
Every Bitcoin address is based on a secret key, from which the public key (associated to a Bitcoin address) is calculated. Once you have the private key for an address, you have the control of that address and can use it to transfer funds.
Revocation checking is in the news again because of a large number of revocations resulting from precautionary rotations for servers affected by the OpenSSL heartbeat bug. However, revocation checking is a complex topic and there's a fair amount of misinformation around. In short, it doesn't work and you are no more…
The first version of LibreSSL portable, 2.0.0, was released a few days ago (followed soon after by 2.0.1 ). Despite the 2.0.x version numbers, these are only preview releases and shouldn't be used in production yet, but have been released to solicit testing and feedback. After testing and examining the codebase, my…
The longer one lurks in the Internet underground, the more difficult it becomes to ignore the harsh reality that for nearly every legitimate online business there is a cybercrime-oriented anti-business. Case in point: Today’s post looks at a popular service that helps crooked online marketers exhaust the Google…
Dual_EC_DRBG is an pseudo-random number generator promoted by NIST in NIST SP 800-90A and created by NSA. This algorithm is problematic because it has been made mandatory by the FIPS norm (and should be implemented in every FIPS approved software) and some vendors even promoted this algorithm as first source of…
I am deeply skeptical of the FBI’s announcement on Friday that North Korea was behind last month’s Sony hack. The agency’s evidence is tenuous, and I have a hard time believing it. But I also have trouble believing that the US government would make the accusation this formally if officials didn’t believe it. Clues in…
Over the past year, I’ve spent a great deal of time trolling a variety of underground stores that sell “dumps” — street slang for stolen credit card data that buyers can use to counterfeit new cards and go shopping in big-box stores for high-dollar merchandise that can be resold quickly for cash. By way of explaining…
We need to support privacy, not for those of us who have "nothing to hide", but for bothersome people like investigative journalists and activists, without which our democracy would crumble
Computer forensics is the science of finding evidence in computers and digital documents, and when a hacker perform forensics, better be prepared for the unknown. Satoshi did many things in order t…
We spent a good chunk of the day investigating the now-famous bash bug (CVE-2014-6271), so I had no time to make too many jokes about it on...
