Every FPGA vendor keeps the bitstream format for their device secret. Only the tools provided in binary-only format by the vendor (and a select few third parties under NDA) can generate these bitstreams.
Winter Break Of Code, Day Fifteen The 1988 film They Live is one of the last great masterpieces to come out of the Hollywood left. In the film, a drifter named John Nada discovers a box of sunglasses that, when worn, allows the wearer to really see the world around him. For instance, when wearin...
Injecting shellcode by overflowing the buffer - Demonstration
EFF, along with eight other consumer-focused privacy advocacy organizations, has backed out of the National Telecommunications Information Administration’s multi-stakeholder process to develop a privacy-protective code of conduct for companies using face recognition. After 16 months of active...
I would like to take a moment to discuss databases. Most people use Shodan to find devices that have web servers, but for a few years now I've also been crawling the Internet for various database software. I usually mention this during my talks and I've tried to raise awareness
Some time ago, I was doing a web application penetration test, and noticed that the authentication tokens were UUIDs. This I knew was risky, and in fact if you read the UUID rfc, section 6 of it wa…
Much has been written about a purported OpenSSH vulnerability. On closer inspection, the reports actually got most of their facts wrong. Rea...
In the last few weeks, a lot of details have been disclosed around Ross Ulbricht’s arrest. For those not familiar with the matter, Ulbricht was arrested at …
Last Wednesday, The Intercept published an expose on the NSA's XKeyscore program. Along with information on the breadth and scale of the NSA's metadata collection, The Intercept revealed how the NSA relies on unencrypted cookie data to identify users. As The Intercept says: "The NSA’s ability to...
As discussed in my previous blogpost, it took about 3 hours to reverse engineer the Lenovo/Superfish certificate and crack the password. In...
Posted by Mark Brand, Truncator of IntegersThis is going to be a quick post, just describing a pa...
Xiaofeng Zheng, Tsinghua University and Tsinghua National Laboratory for Information Science and Technology; Jian Jiang, University of California, Berkeley; Jinjin Liang, Tsinghua University and Tsinghua National Laboratory for Information Science and Technology; Haixin Duan, Tsinghua University, Tsinghua National…
We do penetration testing, source code auditing and vulnerability assessments
All too often, new police surveillance tools are initially applied to only the “worst of the worst” and then slowly—but surely—expanded to include an ever-growing number of less culpable individuals. We’ve seen it with DNA collection. And now we’re starting to see it with GPS tracking. That’s why...
Since our report last week on Australia's Internet censorship bill, the bill did indeed pass the Senate yesterday, and will become the Copyright Amendment (Online Infringement) Act 2015. The new law provides an accelerated process for rightsholders to obtain court orders for ISPs to block sites...
If you were to browse Amazon right now and someone was eavesdropping on your connection, they could tell exactly what you were looking at. They could even tell what you've bought.
I gave a talk a couple of weeks ago at the Yahoo Unconference . The conference was at the end of a particually hard week for a bunch of reasons and I fear that the talk wasn't that great. (Afterwards I got home about 3pm and pretty much slept until the following morning.) This post is a, hopefully clearer…
Years of abusive implementation of webfonts has landed the feature under the umbrella of content blocking APIs, affecting those few who’ve cared all along.
The article here sums up pretty well the debacle that North American tournament Scrabble players have been faced with since the…
By @breenmachine What? The most underrated, underhyped vulnerability of 2015 has recently come to my attention, and I’m about to bring it to yours. No one gave it a fancy name, there were no …
A Ukrainian hacker who once hatched a plot to have heroin sent to my Virginia home and then alert police when the drugs arrived had his first appearance in a U.S. court today, after being extradited to the United States to face multiple cybercrime charges.
A federal magistrate judge in Brooklyn took an admirable stand last week when he questioned the government’s authority to compel Apple to unlock a seized mobile device using the All Writs Act. That’s a general-purpose law passed in 1789 that allows a court to require third parties’ assistance to...
Update (24 July 2015): The French Constitutional Council shows again its disregard for fundamental rights. This morning, after approving almost all dispositions in the Surveillance law, the Constitutional Council builds momentum by rejecting the Question Prioritaire de ConstitutionalitéThe QPC is a
A major part of securing a network as geographically diverse as CloudFlare’s is protecting data as it travels between datacenters. Customer data and logs are important to protect but so is all the control data that our applications use to communicate with each other.
