91
92
Obtaining Wildcard SSL Certificates from Comodo via Dangling Markup Injection
A Hacker's Blog of Unintended Use and Insomnia.
93
EC2's most dangerous feature
A review for readers unfamiliar with this feature: Amazon IAM ( Identity and Access Management ) is a service which allows for the creation of access credentials which are limited in scope; for example, you can have keys which can read objects from Amazon S3 but cannot write any objects. IAM Roles for EC2 are a…
94
95
My Priorities for the Next Four Years
Like many, I was surprised and shocked by the election of Donald Trump as president. I believe his ideas, temperament, and inexperience represent a grave threat to our country and world. Suddenly, all the things I had planned to work on seemed trivial in comparison. Although Internet security and privacy are not the…
96
Counterfeit Macbook charger teardown: convincing outside but dangerous inside
What's inside a counterfeit Macbook charger? After my Macbook charger teardown , a reader sent me a charger he suspected was counterfeit. ...
97
Why NSA Surveillance Scares Me
Nothing To Hide explains why you should care about surveillance even though you have nothing to hide. But it missed the point that most con...
98
99
100
Cracking the Adventure Time cipher
I recently read “Adventure Time: Volume 1”, a comic book based on the smart animated series of the same name. In the comic, I found some odd looking messages at the …
101
To Know If the Election Was Hacked, Look at the Ballots
You may have read at NYMag that I’ve been in discussions with the Clinton campaign about whether it might wish to seek recounts in critical…
102
European Union dedicated questionnaire on the Encryption of Data
On both sides of Atlantic the debate around strong cryptography frequently resurfaces. Proponents of weakening cryptography or introduction of backdoors (or "golden keys") cite national security. Technologists and activists oppose such proposals, citing freedoms and cybersecurity. Regulating cryptography is of course…
103
Alert: NPM modules hijacked
<p><strong>EDIT : User @nj48 appears to <a href="https://twitter.com/seldo/status/712673227630313472">have no malicious intentions</a>.</strong></p>
104
105
NSA Hacked French President’s House
“Keith Alexander (Director of the NSA) told me he was disappointed because he never thought we would detect them and he even added: You guys are good.” Bernard Barbier French newspaper …
106
107
How Candy Japan got credit card fraud somewhat under control
Credit card fraud can be a huge problem for subscription boxes. Here's how we got our situation under control.
108
Outlook 2016’s New POP3 Bug Deletes Your Emails
Yikes, looks like the new version of Outlook 20016 has broken the POP3 implementation. If you are currently using the “leave on server and delete after x days” function, the you should check your account because it seems like that the new Outlook is actually deleting your emails almost immediately after retrieving…
109
Reversing the Petya ransomware with constraint solvers
With the advent of anonymous online money transactions (read Bitcoin ) ransomware has become a profitable business in the cybercrime indu...
110
How to Crash Systemd in One Command
After running this command, PID 1 is hung in the pause system call. You can no longer start and stop daemons. inetd-style services no longer accept connections. You cannot cleanly reboot the system. The system feels generally unstable (e.g. ssh and su hang for 30 seconds since systemd is now integrated with the login…
111
The Basics of Web Application Security
Security is both very important and often under-emphasized. While many targeted techniques help, there are some basic clean code habits which every developer can and should be doing
112
Why I’m not speaking at CPDP: It’s the privacy-washing
13 Jan, 2016 The sponsorship of privacy and human rights conferences by corporations that erode our privacy and human rights is a clear conflict of interests that we must challenge. The revolution will not be sponsored by those we are revolting against.
113
How your data is collected and commoditised via “free” online services
I get a lot of people popping up with data breaches for Have I been pwned [https://haveibeenpwned.com/] (HIBP). There’s an interesting story in that itself actually, one I must get around to writing in the future as folks come from all sorts of different backgrounds and offer
114
Thomas Jefferson and Apple versus the FBI
When Prohibition began, anti-alcohol crusaders demanded that the St. Louis Public Library burn every book that explained "the home production of alcohol for drinks". The librarian insisted on keeping the books but agreed to hide them from the "general public".
115
Why I stopped using StartSSL (Hint: it involves a Chinese company)
StartSSL uses https://auth.startssl.com/ for the front-end to access to their PKIs (login to the PKI, create, revoke certificates...). It's the Core of their service and the critical part of their infrastructure.
116
Securing a travel iPhone
These are dry notes I took in the process of setting up a burner iPhone SE as a secure travel device. They are roughly in setup order.
117
118
Undocumented Facebook API to identify friends in photos
So last week I was casually browsing through Facebook feed and looking at some random photo posted by a friend. So hovering over the pictur...
119
The Signal protocol for Node and browsers
Signal is a protocol for encrypted chat. Developed by Moxie Marlinspike and Trevor Perrin, the Signal protocol backs the excellent Signal Messenger , and has since been incorporated into WhatsApp, Facebook Messenger and Google Allo.
120