241
242
243
Malicious Use of the HTML5 Vibrate API
There is a new API in town! HTML5 will (soon) let you make the user's device vibrate. What fun! Obviously, it's useful for triggering alerts, improved immersivness during gameplay, and all sorts of other fun things like sending Morse Code messages via vibration. At the moment, Chrome (and other Android browsers) ask…
244
Something is amiss with the Interwebs: BGP is a flapping
Something is amiss with the Interwebs! BGP is a flapping. , Author: Adrien de Beaupre
245
Hacking Airline Lounges for Free Meals
I think this is a great hack: A man bought a first-class ticket and used it to have free meals and drinks at the airport’s VIP lounge almost every day for nearly a year, Kwong Wah Yit Poh reported. The itinerary for the ticket was found to have been changed more than 300 times within a year, and the owner of the…
246
CloudFlare enabling free SSL by mid-October
As of today, there are only about 2 million websites that support HTTPS. That's a shamefully low number. Two things are about to happen that we at CloudFlare are hopeful will begin to change that and make everyone love locks (at least on the web!).
247
248
249
Own your own data
A new system would allow individuals to pick and choose what data to share with websites and mobile apps.
250
Unraveling NSA's TURBULENCE Programs
The NSA TURBULENCE program was first revealed in 2007 by the Baltimore Sun for being over-budget and poorly-managed 1 2 . Many documents from the Snowden trove from the past two years reference parts of this program, but no coherent story or overview of how these programs operate together has been described. This is…
251
252
Escaping the Safari sandbox with a kernel GPU bug
Posted by Ian BeerTL;DRAn OS X GPU driver trusted a user-supplied kernel C++ object pointer and c...
253
Craig Gentry named MacArthur Fellow for work on fully homomorphic encryption
Fueling a revolution in cryptography and theoretical computer science through his breakthroughs in fully homomorphic encryption, leading to the possibility of more secure cloud computing.
254
Bash bug: the other two RCEs, or how we chipped away at the original fix
The patch that implements a prefix-based way to mitigate vulnerabilities in bash function exports has been out since last week and has been...
255
Target Hackers Broke in via HVAC Company
Last week, Target told reporters at The Wall Street Journal and Reuters that the initial intrusion into its systems was traced back to network credentials that were stolen from a third party vendor. Sources now tell KrebsOnSecurity that the vendor in question was a refrigeration, heating and air conditioning…
256
257
258
Predicting the next Math.random() in Java
A while back a friend of mine hosted a programming competition where you were given 9 random numbers one at a time and you had to guess the rank (the sorted position amongst the 9) of each as they are coming in. The goal was to submit a strategy in Java that will maximize the number of these games won. The best…
259
260
261
Algorithmic complexity attacks and libc qsort()
An algorithmic complexity attack is a denial of service attack that triggers worst case behaviour in code that is otherwise expected to perform well. The canonical example would be the widely published attacks against hash table implementations , where carefully crafted inputs made snappy \(O(1)\) operations…
262
Your Wireless Router Is Broken – Help Us Fix It At DEF CON
As part of our Open Wireless Movement, we set out to create router software that would make it easier for people to safely and smartly share part of their wireless network. Protecting hosts, so their security is not compromised because they offer open networks, is one of the goals of the router...
263
264
The Linux Security Circus: On GUI isolation
There certainly is one thing that most Linux users don't realize about their Linux systems... this is the lack of GUI-level isolation, and ...
265
266
267
Gradually sunsetting SHA-1
Cross-posted on the Chromium Blog The SHA-1 cryptographic hash algorithm has been known to be considerably weaker than it was designed t...
268
269
How Verizon's Advertising Header Works
Over the past couple of days, there’s been an outpouring of concern about Verizon’s advertising practices. Verizon Wireless is injecting a unique identifier into web requests, as data transits the network. On my phone, for example, here’s the extra HTTP header. 1
270
Incident Report – DDoS Attack
On Monday, December 1st, 2014, we experienced a major volumetric DDoS attack aimed at a customer's domain. Here is our full report.