A court filing unsealed late Wednesday shows that the U.S. Department of Justice (DOJ) made a highly misleading argument to an appeals court in October during a hearing on the constitutionality of National Security Letters (NSLs). On October 8, the Electronic Frontier Foundation argued before the...
The German government is pressuring Neocities to censor a disclosure of their censorship list.
FBI agents arrested a Mexican tycoon named Jose Susumo Azano Matsura at his Coronado, Calif. home on Wednesday as part of a political bribery investigation based on captured emails, seized banking records, and covertly recorded conversations. The unfolding scandal is soaked in irony: Azano is a...
Broadcom Community - VMTN, Mainframe, Symantec, Carbon Black
If it wasn't MtGox I wouldn't even mention it — XSS/fixation/etc are web sec routines, and are not worth a blog post. But it *is* MtGox. W...
The Heartbleed bug in OpenSSL has resulted in a fair amount of damage across the internet. The bug itself was quite simple and is a textbook case for why programming in unsafe languages like C can be problematic. As an experiment to see if a safer systems programming language could have prevented the bug I tried…
There seems to be some kind of misunderstanding about the Google Search/Web History disable switch that google provides to its more privacy conscious users. It’s not exactly the most advertised feature (you won’t find it in your profile page) to begin with, but once you do find it (it’s on the history page, you have…
Explore thought leadership, industry insights, and other resources related to cybercrime detection, disruption, and takedowns.
jQuery: The Write Less, Do More, JavaScript Library
Earlier this month a new paper by Naomi Benger, Joop van de Pol, Nigel Smart, and Yuval Yarom hit the news . The paper explains how to recover secret keys from OpenSSL's implementation of ECDSA-secp256k1 using timing information from "as little as 200 signatures"; ECDSA-secp256k1 is the signature system used by…
Official transparency report on the November 2014 BrowserStack security breach involving a legacy prototype server (Shellshock). Incident fully resolved. BrowserStack is now SOC 2 Type II, ISO 27001:2022, and GDPR compliant. Trusted by 50,000+ companies.
Eloi Vanderbéken recently found a backdoor on some common routers, which is described on his GitHub here. Basically, a process that listens on the 32764 TCP port runs, sometimes accessible from the WAN interface. We scanned the v4 Internet to look for the routers that have this backdoor wild open, and gathered some…
What happened Recently it was announced that a coalition of government agencies took control of...
The Sophos Blog
Explore the Duo Blog for expert tips, security insights, and resources to stay updated on the latest in security and access management trends.
I heard about this guy, walked into a federal bank with a portable phone, handed the phone to the teller, the guy on the other end of the phone said: “We got this guy’s little girl, and if you don’t give him all your money, we’re gonna
Posted by Elie Bursztein, Anti-Abuse Research Lead Earlier this year, we deployed a new TLS cipher suite in Chrome that operates three tim...
The latest news from Google on open source releases, major projects, events, and outreach programs for early career developers.
Google Play: Whats the newest threat on the official Android market?
[caption]ComputerCOP in Maricopa County, Arizona[/caption] For years, local law enforcement agencies around the country have told parents that installing ComputerCOP software is the “first step” in protecting their children online. Police chiefs, sheriffs, and district attorneys have handed out...
At this time last year, the TLS world was mostly running on RC4-SHA and AES-CBC. The Lucky 13 attack against CBC in TLS had just been published and I had spent most of January writing patches for OpenSSL and NSS to implement constant-time CBC decoding. The RC4 biases paper is still a couple of week away, but it's…
NOTE: malware is now using this as their User-agent. I haven't run a scan now for over two days. I'm running a scan right now of the I...
People often suggest that inline PGP signatures in e-mail are somehow more compatible or more acceptable than using PGP/MIME . This is a mistake. Inline PGP signatures are prone to several failure modes, up to and including undetectable message tampering.
Today, we are excited to announce the introduction of Elastic Endpoint Security.
From Betty Medsger’s book on the 1971 FBI burglary (page 22): As burglars, they used some unusual techniques, ones Davidon enjoyed recalling years later, such as what some of them did in 1970 at a draft board office in Delaware. During their casing, they had noticed that the interior door that opened to the draft…
