271
272
Fun with Shellshock
This is great work. Though I must confess I’m more interested (and far more uneasy) about the other side of the coin — people developing projects like these involving machine learning to find and exploit the vulnerabilities in a fully automated fashion. This is related to, but not quite the same as, attempts at…
273
TrueCrypt Master Key Extraction And Volume Identification
One of the disclosed pitfalls of TrueCrypt disk encryption is that the master keys must remain in RAM in order to provide fully transparent...
274
Why Apple's iPhone encryption won't stop NSA
Recent news headlines have made a big deal of Apple encrypting more of the storage on their handsets, and claiming to not have a key. Depend...
275
276
Libtls – New TLS API from LibreSSL
tls_init , tls_config_new , tls_config_free , tls_config_error — initialize TLS client and server API
277
Microsoft Says: Come Back with a Warrant, Unless You’re Microsoft
Update (March 28, 2014): Microsoft has announced a new policy which is described in a new post. EFF has long argued that law enforcement agencies must get a warrant when they ask Internet companies for the content of their users’ communications. In 2013, as part of our annual Who Has Your Back...
278
279
An Update to End-To-End
Posted by Stephan Somogyi, Product Manager, Security and Privacy In June, we announced and launched End-To-End , a tool for those who need...
280
Lorem Ipsum: Of Good and Evil, Google and China
Imagine discovering a secret language spoken only online by a knowledgeable and learned few. Over a period of weeks, as you begin to tease out the meaning of this curious tongue and ponder its purpose, the language appears to shift in subtle but fantastic ways, remaking itself daily before your eyes. And just when you…
281
282
TextSecure's Private Group Messaging
One of the major features we introduced in the TextSecure v2 release was private group chat. We believe that group chat is an important feature for encrypted communications projects, so we wanted to try to summarize some of the existing work in this area, as well as how TextSecure’s group chat pr...
283
284
The security hole I found on Amazon.com
A blog about building stuff on the web by Josh Fraser
285
Dropbox wasn't hacked
At Dropbox, security is our highest priority. Find out how Dropbox secures your files and data, and why millions of people trust us with what matters most.
286
287
288
DEFCON Router Hacking Contest Reveals Major Vulnerabilities
"I could take down the internet with that, and so could you." Dan Geer, Chief Information Security Officer of CIA’s venture capital arm, didn't mince words when he mentioned the security flaws in home routers during his keynote address at last month's Black Hat conference in Las Vegas. But he also...
289
Chrome Bugs Allow Sites to Listen to Your Private Conversations
New bugs in Google Chrome, allow malicious sites to activate your microphone, and listen in on anything said around your computer, even after you’ve left those sites.
290
Apple CoreGraphics framework logging input data to /tmp
Security researcher Kent Howard reported an Apple issue present in OS X 10.10 (Yosemite) where log files are created by the CoreGraphics framework of OS X in the /tmp local directory. These log files contain a record of all inputs into Mozilla programs during their operation. In versions of OS X from versions 10.6…
291
292
The Rise of Thin, Mini and Insert Skimmers
Like most electronic gadgets these days, ATM skimmers are getting smaller and thinner, with extended battery life. Here’s a look at several miniaturized fraud devices that were pulled from compromised cash machines at various ATMs in Europe so far this year.
293
Chaos Computer Club Supports Chelsea Manning and Edward Snowden
Since its founding more than thirty years ago, the Chaos Computer Club (CCC) holds strong beliefs in the freedom of information. Consequentially, freedom fighters and whistleblowers deserve our...
294
295
Heartbleed and Static Analysis
The issue with things like Frama-C is that they are by far the easiest to use if you start out a project using them, and you often don’t know which projects you retroactively wished you had done so until they are big and crufty.
296
Snowden-haters are on the wrong side of history
In the autumn on 1963, J. Edgar Hoover’s FBI, worried at Martin Luther King’s growing influence, began tapping his phones and bugging his hotel rooms. They hoped to discredit him by gai…
297
298
299
The Insecurity of Secret IT Systems
We now know a lot about the security of the Rapiscan 522 B x-ray system used to scan carry-on baggage in airports worldwide. Billy Rios, director of threat intelligence at Qualys, got himself one and analyzed it. And he presented his results at the Kaspersky Security Analyst Summit this week. It’s worse than you might…
300
Google Exploit – Steal Account Login Email Addresses
I found a bug that allowed me to find anyone with a Google+ account's login email address. This could be used to target specific people for spear phishing.