451
Non-official MtGox investigation update and preliminary release
The official blog of WizSec, a group of bitcoin security specialists, and their investigation into MtGox.
452
Police Must Respect the Right of Citizens to Record Them
“I’m asking all the citizens of North Charleston to continue taping.” That is what Councilwoman Dorothy Williams said in response to the shooting death of Walter Scott. She and others recognize that the story would have been very different without the video showing that a white police officer shot...
453
454
Lizard Stresser Runs on Hacked Home Routers
The online attack service launched late last year by the same criminals who knocked Sony and Microsoft ’s gaming networks offline over the holidays is powered mostly by thousands of hacked home Internet routers, KrebsOnSecurity.com has discovered.
455
456
Faking the TCP handshake
Update: This article has been superseded by a new post which hopefully explains it more clearly: Spoofing TCP connections without sequence number prediction
457
458
California’s DNA Law Violates Privacy Protections Guaranteed by State
San Francisco—Californians who’ve merely been arrested and not charged, much less convicted of a crime, have a right to privacy when it comes to their genetic material, EFF said in an amicus brief filed Nov. 13 with the state’s highest court. EFF is urging the California Supreme Court to hold that...
459
Fuzzing FFmpeg for fun and profit
One of the great things about having rack-space in our new office is that we can now support open source projects using our equipment such as FFmpeg and Libav. They are critical parts of our software as well as underpin much of multimedia processing in the world today.
460
461
How botnets are created with hijacked Worpess, fake Flash downloads and Node.js
I just noticed the website of an old employer has been hacked and some JavaScript is injected into their corporate website that runs on WordPress. Ouch. Of course I notified them about it and they’re just trying to figure out what happened and how to fix it.
462
The Inside Story Behind MS08-067
Access to this page requires authorization. You can try signing in or changing directories .
463
Introducing Docker Content Trust
Docker is a founding member of the Blueprint Alliance, a 12-company reference architecture for securing AI agents, built around four governance questions.
464
Let’s encrypt automation on Debian
NOTE: This article is old, this hack is no longer necessary, as Debian includes dehydrated that makes all the work. Free SSL certificates for everyone! the https://letsencrypt.org/ initiative backed by Akamai, Cisco, Mozilla and EFF, is going to offer free certificates. On this post I am going to explain how I have…
465
466
From kafkatrap to honeytrap
The short version is: if you are any kind of open-source leader or senior figure who is male, do not be alone with any female, ever, at a technical conference. Try to avoid even being alone , ever, because there is a chance that a “women in tech” advocacy group is going to try to collect your scalp.
467
468
469
How To Create an SSH CA to Validate Hosts and Clients with Ubuntu
When dealing with an extensive infrastructure and many team members, managing SSH keys for authentication can become unwieldy. However, SSH can utilize cert…
470
The CA's Role in Fighting Phishing and Malware
Since we announced Let’s Encrypt we’ve often been asked how we’ll ensure that we don’t issue certificates for phishing and malware sites. The concern most commonly expressed is that having valid HTTPS certificates helps these sites look more legitimate, making people more likely to trust them. Deciding what to do here…
471
ImperialViolet
Thomas Ptacek laid out a number of arguments against DNSSEC recently (and in a follow up ). We don't fully agree on everything, but it did prompt me to write why, even if you assume DNSSEC, DANE (the standard for speaking about the intersection of TLS and DNSSEC) is not a foregone conclusion in web browsers.
472
How the new Gmail image proxy works and what this means for you
Google recently announced that images in emails will be displayed automatically by default to Gmail users, thanks to an anonymizing proxy operated by them.
473
Why ninety-day lifetimes for certificates?
This is a historic blog post at this point. Please see our certificate lifetime documentation for the current status of certificate lifetimes. We’re sometimes asked why we only offer certificates with ninety-day lifetimes. People who ask this are usually concerned that ninety days is too short and wish we would offer…