61
62
Learning from a Year of Security Breaches
This year (2016) I accepted as much incident response work as I could. I spent about 300 hours responding to security incidents and data…
63
Google's login page accepts a vulnerable GET parameter
In hope that public disclosure will encourage Google to fix this, despite refusing to, here goes...
64
SSH for Fun and Profit
In May last year, a new attack on the Diffie Hellman algorithm was released, called Logjam . At the time, I was working on a security team, so it was our responsiblity to check that none of our servers would be affected. We ran through our TLS config and decided it was safe, but also needed to check that our SSH…
65
66
67
A single byte write opened a root execution exploit
Thursday, September 22nd 2016. An email popped up in my inbox. Subject: ares_create_query OOB write As one of the maintainers of the c-ares project I'm receiving mails for suspected security problems in c-ares and this was such a one. In this case, the email with said subject came from an individual who had reported a…
68
A very valuable vulnerability
The vulnerability — which has since been fixed, or else I would not be writing about it publicly — was in Stripe's bitcoin payment functionality . Some background for readers not familiar with this: Stripe provides payment processing services, originally for credit cards but now also supporting ACH, Apple Pay, Alipay…
69
An XSS on Facebook via PNGs and Wonky Content Types
Bug Bounty & Application Security
70
Early Impacts of Let's Encrypt
During the months I worked in Let's Encrypt's operations team I got fairly used to being the go-to man for any question that a database query could solve.…
71
Scammers Game Amazon A-Z Policy By Replacing iPhones With Clay
This morning I discovered some rather anomalous 1-star reviews on Amazon for the Apple iPhone 6s 128 GB. About 17% of the reviews for that product are 1-star...
72
Obscurity Is a Valid Security Layer
Good Obscurity vs. Bad Obscurity Camouflage OPSEC An SSH Example Reducing Impact or Probability Summary Many of us are familiar with a concept know as Security
73
74
75
Android security in 2016 is a mess
Summary Your phone probably contains banking, payment and personal information that can be remotely stolen via numerous known and unknown bugs in the Android software. This is attractive to criminals. Vendors (LG, Samsung, Xiaomi, etc.), after selling you their phone, have no incentive to keep your phone’s software up…
76
77
ECDSA smartphone key extraction using $2 magnetic probe
We show that modern cryptographic software on mobile phones, implementing the ECDSA digital signature algorithm, may inadvertently expose its secret keys through physical side channels: electromagnetic radiation and power consumption which fluctuate in a way that depends on secret information during the cryptographic…
78
Let's Encrypt and Nginx – State of the art secure web deployment
An overview of a secure web deployment with Let's Encrypt and Nginx. How to set up a valid HTTPS connection, harden it and get top security ratings.
79
FBI Harassment
Obligatory Disclaimer: Personal or political views presented within this post absolutely do not reflect those of my employer(s), client(s), and/or legal counsel.
80
SSH: Best practices
The comments around the last OpenSSH issue ( CVE 2016-0777 , you must read excellent Qualys’ analysis if you’re interested with the details), I noticed that many people were not aware of some basic features of OpenSSH. I will attempt to give a few advises, prioritized in feasibility order, and with graphical…
81
Curl Security Audit
"the overall impression of the state of security and robustness of the cURL library was positive." I asked for, and we were granted a security audit of curl from the Mozilla Secure Open Source program a while ago. This was done by Mozilla getting a 3rd party company involved to do the job and footing … Continue…
82
Site requests bank logins for online purchases
I’ve spent a lot of time trying to educate people on being careful with credentials. It really doesn’t help when I try to place a purchase with a “legitimate” supplier, and, after handing over valid credit card details, I get this:
83
Breaking homegrown crypto
Anubis could not load its JavaScript. The server may be overloaded. Please reload the page to try again.
84
On Cybersecurity and Being Targeted
Last month, I was the subject of a targeted cyber attack. Someone went through substantial lengths to attempt to gain access to my GitHub account, but were...
85
86
Chinese CA WoSign faces revocation after possibly issuing fake certificates
This website is for sale! percya.com is your first and best source for information about percya. Here you will also find topics relating to issues of general interest. We hope you find what you are looking for!
87
88
CIA Director John Brennan Pretends Foreign Cryptography Doesn't Exist
Last week, CIA director John Brennan told a Senate committee that there wasn’t any strong cryptography outside of the US. CIA director John Brennan told US senators they shouldn’t worry about mandatory encryption backdoors hurting American businesses. And that’s because, according to Brennan, there’s no one else for…
89
90
Understanding the ginormous Philippines data breach
Remember when OPM got breached last year [https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach]? There was a lot of excitement in various parts of the world (namely the US) because here we had a government department (Office of Personnel Management), and they’d just lost 21.