181
182
Account hijacking on MtGox
If it wasn't MtGox I wouldn't even mention it — XSS/fixation/etc are web sec routines, and are not worth a blog post. But it *is* MtGox. W...
183
Preventing heartbleed bugs with safe programming languages
The Heartbleed bug in OpenSSL has resulted in a fair amount of damage across the internet. The bug itself was quite simple and is a textbook case for why programming in unsafe languages like C can be problematic. As an experiment to see if a safer systems programming language could have prevented the bug I tried…
184
Google Search/Web history disable does nothing for privacy
There seems to be some kind of misunderstanding about the Google Search/Web History disable switch that google provides to its more privacy conscious users. It’s not exactly the most advertised feature (you won’t find it in your profile page) to begin with, but once you do find it (it’s on the history page, you have…
185
How to design an elliptic-curve signature system
Earlier this month a new paper by Naomi Benger, Joop van de Pol, Nigel Smart, and Yuval Yarom hit the news . The paper explains how to recover secret keys from OpenSSL's implementation of ECDSA-secp256k1 using timing information from "as little as 200 signatures"; ECDSA-secp256k1 is the signature system used by…
186
187
The Increasing Trend of Online Extortion
I heard about this guy, walked into a federal bank with a portable phone, handed the phone to the teller, the guy on the other end of the phone said: “We got this guy’s little girl, and if you don’t give him all your money, we’re gonna
188
189
TLS Symmetric Crypto
At this time last year, the TLS world was mostly running on RC4-SHA and AES-CBC. The Lucky 13 attack against CBC in TLS had just been published and I had spent most of January writing patches for OpenSSL and NSS to implement constant-time CBC decoding. The RC4 biases paper is still a couple of week away, but it's…
190
Bash 'shellshock' scan of the Internet
NOTE: malware is now using this as their User-agent. I haven't run a scan now for over two days. I'm running a scan right now of the I...
191
Inline PGP signatures considered harmful
People often suggest that inline PGP signatures in e-mail are somehow more compatible or more acceptable than using PGP/MIME . This is a mistake. Inline PGP signatures are prone to several failure modes, up to and including undetectable message tampering.
192
1971 Social Engineering Attack
From Betty Medsger’s book on the 1971 FBI burglary (page 22): As burglars, they used some unusual techniques, ones Davidon enjoyed recalling years later, such as what some of them did in 1970 at a draft board office in Delaware. During their casing, they had noticed that the interior door that opened to the draft…
193
How Jason Bourne Stores His Bitcoin
If you want to invest in bitcoin for the long-haul, you should address the thorny issue of how best to store them. Since people love stealing bitcoins from others more than just about anything else in this world, all storage systems must first and foremost:
194
2,000 NHS Security Vulnerabilities Disclosed
This is part 3 of a series of blog posts looking at the security of the UK Government's web infrastructure. Britain's National Health Service is riddled with old and insecure WordPress-based websites. Many of these sites have severe flaws including being vulnerable to XSS attacks. There is absolutely no suggestion…
195
Root a Mac in 10 seconds or less
Often times, physical access to a machine means game over. While people like to think that OSX is immune to most security threats, even Apple computers can be susceptible to physical attacks. Mac OSX is capable of booting into single user mode by holding a special key combination (Command-S). From this point, an…
196
Authentication for Single Page Apps
Wow! This takes me back! Please check the date this post was authored, as it may no longer be relevant in a modern context.
197
SSL Labs: Stricter security requirements for 2014
Today, we're releasing a new version of SSL Rating Guide as well as a new version of SSL Test to go with it. Because the...
198
The Sad State of Mobile XMPP in 2014
blog about networking, cameras, old gear, and xmpp
199
Bypassing a Python sandbox by abusing code objects
Awhile ago, I stumbled upon a service that let you write python-bots to interact with a number of external services. The basic idea was th...
200
201
The New Normal: 200-400 Gbps DDoS Attacks
Over the past four years, KrebsOnSecurity has been targeted by countless denial-of-service attacks intended to knock it offline. Earlier this week, KrebsOnSecurity was hit by easily the most massive and intense such attack yet — a nearly 200 Gbps assault leveraging a simple attack method that industry experts say is…
202
You Don't Want XTS
XTS is the de-facto standard disk encryption mode, which makes it look like a good general-purpose one. It isn't. What disk encryption actually promises, and why XTS's guarantees don't travel.
203
sean cassidy : Don't Pipe to your Shell
It's everywhere . Sometimes they tell you to ignore certificates as well (looking at you, Salt). That's dumb.
204
How To Safely Generate A Random Number
Use urandom. That is the whole answer. Why the entropy-depletion story is a myth, and why userspace CSPRNGs are behind most of the last decade's randomness disasters.