211
Reversing Go Binaries Like a Pro
GO binaries are weird, or at least, that is where this all started out. While delving into some Linux malware named Rex, I came to the realization that I might need to understand more than I wanted to
212
Improved Authentication for Email Encryption and Security
Today, we are happy to become the first and only secure email service to support Secure Remote Password (SRP), a much more secure authentication method.
213
Finland: New surveillance law threatens fundamental rights (2015)
Finnish EDRi member Electronic Frontier Finland (Effi) is gravely concerned over a draft law on Internet surveillance. The bill that the country’s current government is in the process of preparing will grant the military and the Finnish Security Intelligence Service (Supo) the authority to conduct electronic mass…
214
On WebKit Security Updates
Linux distributions have a problem with WebKit security. Major desktop browsers push automatic security updates directly to users on a regular basis, so most users don't have to worry about security updates. But Linux users are dependent on their distributions to release updates. Apple fixed over 100 vulnerabilities…
215
Tails installer is now in Debian
Tails (The amnesic incognito live system) is a live OS based on Debian GNU/Linux which aims at preserving the user's privacy and anonymity by using the Internet anonymously and circumventing censorship. Installed on a USB device, it is configured...
216
The Difficulty of Private Contact Discovery
Building a social network is not easy. Social networks have value proportional to their size, so participants aren’t motivated to join new social networks which aren’t already large. It’s a paradox where if people haven’t already joined, people aren’t motivated to join. The trouble is that whi...
217
Cisco Adaptive Security Appliance SNMP Remote Code Execution Vulnerability
A vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to a buffer overflow in the affected code area. The…
218
Thinking About Smart Contract Security
Over the last day with the community's help we have crowdsourced a list of all of the major bugs with smart contracts on Ethereum so far, including both the...
219
New debugging method found undetected security flaws in popular web apps
By exploiting some peculiarities of the popular Web programming framework Ruby on Rails, MIT researchers have developed a system that can quickly comb through tens of thousands of lines of application code to find security flaws.
220
Tor Browser User Manual
The community team is excited to announce the new Tor Browser User Manual! The manual is...
221
Apple Remote Code Execution with Image Files
Vulnerabilities discovered by Tyler Bohan of Cisco Talos. Many of the wide variety of file formats are designed for specialized uses within specific industries. Apple offers APIs as interfaces to provide a definitive way to access image data for multiple image formats on the Apple OS X platform. Talos is
222
Distrusting New WoSign and StartCom Certificates
Mozilla has discovered that a Certificate Authority (CA) called WoSign has had a number of technical and management failures. Most seriously, we discovered they were backdating SSL certificates in order ...
223
The UK's Proposed Spy Law Would Force Apple to Secretly Hack its Phones Too
The FBI's demand that Apple craft new software to bypass iOS's security protections has ignited a worldwide debate about a government's ability to force tech companies to sabotage their own security. One repeated question has been: will other countries, like China, demand the same powers? You don't...
224
25 Civil Liberties Orgs Call for Open Hearings on Section 702 Surveillance
The House Judiciary Committee has plans for a “members only” meeting next week to discuss Section 702 of the FISA Amendment Acts, the law the NSA relies on to operate its notorious PRISM surveillance program and to tap into the backbone of the Internet, also known as “upstream” collection. While we...
225
Updated Firefox Security Indicators
Cross posting this. It was written a couple months ago and posted to Mozilla’s Security Blog This article was coauthored by Aislinn Grigas, Senior Interaction Designer, Firefox Desktop November 3, 2015 Over the past few months, Mozilla has been improving the user experience of our privacy and security features in…
226
227
Qubes OS Begins Commercialization and Community Funding Efforts
Since the initial launch of Qubes OS back in April 2010, work on Qubes has been funded in several different ways. Originally a pet project, it was first supported by Invisible Things Lab (ITL) out of the money we earned on various R&D and consulting contracts. Later, we decided that...
228
Is HTTP Public Key Pinning Dead?
HTTP Public Key Pinning (HPKP, RFC 7469)—a standard that was intended to bring public key pinning to the masses—might be dead.
229
Here’s to more HTTPS on the web
Security has always been critical to the web, but challenges involved in site migration have inhibited HTTPS adoption for several years. In the interest of a safer web for all, at Google we've worked alongside many others across the online ecosystem to better understand and address these challenges, resulting in real…
230
231
China Shows How Surveillance Leads to Intimidation and Software Censorship
Xinjiang, home of the China's muslim Uighur minority, has long been the world's laboratory for Internet repression. Faced with widespread local unrest, and online debate, China has done everything it can to enforce its vision of the Net in the region, from imprisoning bloggers and online publishers...
232
233
234
The Crime of Speech
New EFF Report Maps Legal Threats to Free Expression in the Arab WorldFreedom of expression is a universal right, but the specific threats to it vary widely from country to country and region to region. As activists fighting for free speech worldwide, it is essential that we better understand the...
235
Moving Towards a More Secure Web
To help users browse the web safely, Chrome indicates connection security with an icon in the address bar. Historically, Chrome has not exp...
236
237
EFF Pries More Information on Zero Days from the Government
Until just last week, the U.S. government kept up the charade that its use of a stockpile of security vulnerabilities for hacking was a closely held secret.[fn]For what it's worth, the government denies having a “Raiders of the Lost Ark style” stockpile of zero days.[/fn] In fact, in response to...
238
239
Executing non-alphanumeric JavaScript without parentheses
I decided to look into non-alphanumeric JavaScript again and see if it was possible to execute it without parenthesis. A few years ago I did a presentation on non-alpha code if you want some more info
240
Bitcoin Users Reveal More Private Information Than They Realize
Most people think bitcoin is anonymous. In fact, new technologies trace BTC transactions, attempting to identify bitcoin users.