181
Why Samsung Knox Isn't Really a Fort Knox
UPDATE #2: Apparently Samsung said in their press release that user should try out My Knox, as Knox Personal is deprecated. I just tried t...
182
German freemail sites trick Firefox and Chrome users into removing AdBlock
German freemail heavyweights web.de and gmx.net (several millions of users combined) are using deceptive techniques in order to manipulate Firefox and Chrome users into removing AdBlock and its var…
183
How printers and Photoshop detect and refuse to process images of currency
Professor Steven J. Murdoch
184
Mandatory encryption on XMPP starts today
Last year Peter Saint-Andre laid out a plan for strengthening the security of the XMPP network. The manifesto, to date signed by over 70 XMPP service operators and software developers, offered a rallying point for those interested in ensuring the security of XMPP for its users. Today is the date that the manifesto…
185
Chrome's experiment of hiding the URL is great for security
iOS has hidden the pathname of URLs for some time now, but recently Chrome Canary introduced something similar behind a flag.
186
187
Recommended Security Reading
dfir.org is the personal page of Andrew Case ( @attrc ). This website serves as a central location for all of my research, software projects, and speaking events.
188
189
Firefox 32 Supports Public Key Pinning
Public Key Pinning helps ensure that people are connecting to the sites they intend . Pinning allows site operators to specify which certif...
190
Npm security post-mortem
npm Blog (Archive); updates from the npm team are now published on the GitHub Blog and the GitHub Changelog
191
Two "WontFix" vulnerabilities in Facebook Connect
TL;DR Every website with "Connect Facebook account and log in with it" is vulnerable to account hijacking. Every website relying on signed_r...
192
193
eBay customers’ personal data was compromised in March
eBay Inc. (Nasdaq: EBAY) said beginning later today it will be asking eBay users to change their passwords because of a cyberattack that compromised a database containing encrypted passwords and other non-financial data.
194
RTFM 0day in iOS apps
DIN INFO IP Adresse ( IPv4 eller IPv6) 104.165.132.197 Port: 47376 Hostnavn: 104.165.132.197 X-Forward IP Adresse(r): Browser (UserAgent): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Forespørgsels Timestamp (Unix tid): 1793882617 Forespørgsels…
195
196
Common LibreSSL porting mistakes
The other day I wrote an article discussing LibreSSL , and the common mistakes being made by those thinking they know how to port it to oth...
197
Zero Knowledge Proofs: An illustrated primer
One of the best things about modern cryptography is the beautiful terminology. You could start any number of punk bands (or Tumblrs) named after cryptography terms like ‘hard-core predicate&#…
198
199
How to steal Bitcoins that are protected by weak passphrases
Every Bitcoin address is based on a secret key, from which the public key (associated to a Bitcoin address) is calculated. Once you have the private key for an address, you have the control of that address and can use it to transfer funds.
200
201
A Shark on the Network
DISCLAIMER: I do not condone monitoring network traffic with intent to spy or otherwise cause harm to people. My interest in the techniques described below is academic. I write in the hope that I can improve Internet security, or at least increase public awareness of vulnerabilities. If you are attempting to replicate…
202
203
204
No, don't enable revocation checking
Revocation checking is in the news again because of a large number of revocations resulting from precautionary rotations for servers affected by the OpenSSL heartbeat bug. However, revocation checking is a complex topic and there's a fair amount of misinformation around. In short, it doesn't work and you are no more…
205
How I was able to track the location of any Tinder user
By Max Veytsman At IncludeSec we specialize in application security assessment for our clients, that means taking applications apart and finding really crazy vulnerabilities before other hackers do. When we have time off from client work we like to analyze popular apps to see what we find. Towards the end of 2013 we…
206
The USA Freedom Act: What's to Come and What You Need to Know
Update, Nov 18: The USA Freedom Act does not renew the entirety of the Patriot Act, which consisted of over 100 sections changing numerous electronic surveillance laws. The USA Freedom Act does extend three provisions of the Patriot Act: the "lone wolf" provision, the "roving wire tap" provision,...
207
LibreSSL's PRNG is Unsafe on Linux
The first version of LibreSSL portable, 2.0.0, was released a few days ago (followed soon after by 2.0.1 ). Despite the 2.0.x version numbers, these are only preview releases and shouldn't be used in production yet, but have been released to solicit testing and feedback. After testing and examining the codebase, my…
208
209
210
Service drains competitor's Adwords budget
The longer one lurks in the Internet underground, the more difficult it becomes to ignore the harsh reality that for nearly every legitimate online business there is a cybercrime-oriented anti-business. Case in point: Today’s post looks at a popular service that helps crooked online marketers exhaust the Google…