271
Amtrak police use of passenger data
[Passenger Name Record (PNR) view from Amtrak “Police GUI”. Click image for larger version.]
272
Bug finding is slow in spite of many eyeballs
"given enough eyeballs, all bugs are shallow" The saying (also known as Linus' law) doesn't say that the bugs are found fast and neither does it say who finds them. My version of the law would be much more cynical, something like: "eventually, bugs are found", emphasizing the 'eventually' part. (Jim Zemlin apparently…
273
Fuzzing a DNS parser written in Go
Here at CloudFlare we are heavy users of the github.com/miekg/dns Go DNS library and we make sure to contribute to its development as much as possible. Therefore when Dmitry Vyukov published go-fuzz and started to uncover tens of bugs in the Go standard library, our task was clear.
274
Android libstagefright still exploitable
Update (2015-08-13 1:16pm CST): We’ve been in contact with Zimperium and are working with them to provide coverage for detection of this flaw through their Stagefright Detector app. They have been very responsive (more so than the affected vendor) and we plan to alert them of similar flaws we’ve recently discovered…
275
United Airlines Bug Bounty: An experience in reporting a serious vulnerability
About six months ago, United Airlines announced their Bug Bounty program and, almost immediately, it received a ton of press. Though I initially wasn’t interested in pursuing the program (mainly due to its popularity), I decided to take a look a week or two after its launch despite being late to the party. Shortly…
276
The sad state of SMTP encryption
This is a quick recap of why I’m sad about SMTP encryption. It explains how TLS certificate verification in SMTP is useless even if you force it.
277
France's Government Aims to Give Itself Carte Blanche to Spy on the World
The United States makes an improper division between surveillance conducted on residents of the United States and the surveillance that is conducted with almost no restraint upon the rest of the world. This double standard has proved poisonous to the rights of Americans and non-Americans alike. In...
278
Patronizing Passwords
Passwords suck. Let’s make them better.
279
280
Comparing how security experts and non-experts stay safe online
Posted by Iulia Ion, Software Engineer - Rob Reeder, Research Scientist - Sunny Consolvo, User Experience Researcher Today, you can find...
281
Saying goodbye to encrypted SMS/MMS
It’s 2015, and the end of the road for encrypted SMS/MMS in TextSecure. The TextSecure story started back in 2009, at the dawn of the smartphone era. Back then, TextSecure focused on securing the transport that everyone coming from feature phones was familiar with: SMS. Today, many things have c...
282
Hacking Oklahoma State University's Student ID
READ THIS AFTER - a full follow up here: http://snelling.io/following-up-hacking-oklahoma-state-universitys-student-id
283
Introducing Heroku Private Spaces
As the world becomes more cloud-centric, and more of our apps and business depend on its capabilities, the trust, control and management of cloud services
284
Why the US federal employee record breach is worse than others
During the week of June 8th, the Office of Personnel Management (OPM) announced that the records of all current and past US federal employees had been compromised. That includes standard employment information - address, social security numbers, etc - of over 4 million people ranging from a random forest ranger to US…
285
When Undercover Credit Card Buys Go Bad
I recently heard from a source in law enforcement who had a peculiar problem. The source investigates cybercrime, and he was reaching out for advice after trying but failing to conduct undercover buys of stolen credit cards from a well-known underground card market. Turns out, the cybercrime bazaar’s own security…
286
Onion names reserved by the IETF
The Internet Engineering Task Force (IETF), the body that sets standards for the Internet, has...
287
Securing access to Wikimedia sites with HTTPS by default
The Wikimedia Foundation is happy to announce that we are implementing HTTPS to encrypt all traffic on Wikimedia sites. With this change, nearly half a billion monthly visitors on Wikipedia and its…
288
A riddle wrapped in a curve
If you’re looking for a nice dose of crypto conspiracy theorizing and want to read a paper by some very knowledgeable cryptographers, I have just the paper for you. Titled “A Riddle Wrapped in an E…
289
Being Sneaky in C
I entered the 2014 Underhanded C Contest last year. Didn't win, but hey-ho what can you do. Still, I thought I'd post my entry and a write-up of it, in case anyone found it interesting.
290
In China, Your Credit Score Is Affected by Your Political Opinions
China's social score system is full of rumor and speculation. We clear up the misconceptions and explain how the credit system really works.
291
What happens when DNS in China is poisoned and pointed at your server
I’ve been using the Internet in one form or another since the mid-80’s. In that time, I’ve seen a lot of strange stuff happening on our global network. On Tuesday, I experienced something extraordinary. It all started with a text message from my partner Ged at 8:30 AM: Mail server down. Please take a look […]
292
293
294
Is Extended Random a Malicious NSA Plot?
Dual_EC was almost certainly an NSA backdoor. Extended Random is the TLS extension that would have made it practical to exploit. Did NSA plant that one too? A look at the evidence.
295
Senator Wants to Make the Computer Fraud and Abuse Act Even Easier to Abuse
This summer, Senator Sheldon Whitehouse introduced an amendment to the flawed Cyber Information Sharing Act (CISA) that would make it even worse, by expanding the broken Computer Fraud and Abuse Act (CFAA). EFF has proposed common sense changes to this federal anti-hacking law, many of which were...
296
297
Users Rationally Rejecting Security Advice (2009)
This paper, by Cormac Herley at Microsoft Research, sounds like me: Abstract: It is often suggested that users are hopelessly lazy and unmotivated on security questions. They chose weak passwords, ignore security warnings, and are oblivious to certicates errors. We argue that users’ rejection of the security advice…
298
Security: OpenBSD vs. FreeBSD
Blog about network and security, showing example of Linux iptables and Snort configuration, and Windows security softwares.
299
Thunderstrike 2: Mac firmware worm details
Collection of my projects and hacks.
300
Victory for CloudFlare Against SOPA-like Court Order
Striking a blow against the continuing effort to force service providers to serve as IP police, CloudFlare and EFF have pushed back against a court order that would have required CloudFlare to monitor its service to enforce a trademark held by a group of music labels. Last week, Judge Alison J....