151
152
153
Dropbox Smeared in Week of Megabreaches
Last week, LifeLock and several other identity theft protection firms erroneously alerted their customers to a breach at cloud storage giant Dropbox.com — an incident that reportedly exposed some 73 million usernames and passwords. The only problem with that notification was that Dropbox didn’t have a breach; the data…
154
CCTV Cameras Sold on Amazon Come with Pre-Installed Malware
I needed a simple set of good outdoor surveillance cameras for a friends home. Like everything else I buy, I turned to Amazon. I found (what seemed like) a great deal for a set of 6 poe cameras and...
155
156
Storing Passwords in a Highly Parallelized World
Why “Use bcrypt.” is not the best recommendation (anymore).
157
Rules for Writing Safety Critical Code (2006)
Ten rules for writing safety critical code, to facilitate analysis and increase software reliability
158
159
1.4B records from “Have I been pwned” for analysis
I get a lot of requests from people for data from Have I been pwned [https://haveibeenpwned.com/] (HIBP) that they can analyse. Now obviously, there are a bunch of people up to no good requesting the data but equally, there are many others who just want to run statistics.
160
161
Guccifer 2.0 Hacked Clinton Foundation
Many of you have been waiting for this, some even asked me to do it. So, this is the moment. I hacked the Clinton Foundation server and downloaded hundreds of thousands of docs and donors’ da…
162
Is duckduckgo.com partially enforcing the “celebrity threesome injunction”?
The "celebrity threesome injuction" forbids publication in England and Wales of the identities of a famous married couple who reportedly had sex with someone else. In other words, nothing bad, or important.
163
What Is the Secure Enclave?
The big tech news this week is that the FBI is trying to force Apple to unlock a suspect's iPhone. One of the interesting points around this story is that the iPhone in question is an older one, an iPhone 5c. Newer phones have what Apple calls the Secure Enclave, which some say protects against requests of this…
164
Something Secret This Way Comes
On the Rust Lint Workshop, I started coding on a “secret” project (Actually I hinted at the possibility during our 100 clippy lints celebration). Now that I’ve built a prototype, it’s time to spill the beans: I wrote a new lint. One might even say a new type of lint. One of the interesting things about this lint is…
165
166
PayPal and zero-dollar invoice spam
I got a rather odd invoice via PayPal the other day, it looks like this: Naturally the first thing I did was to look for spoof email indicators, but none of the usual suspects were showing up: 1. It was from member@paypal.com.au 2. The mail headers were
167
168
169
NPM Package Hijacking From the Hijacker's Perspective
In light of recent events in the javascript community, I would like to share the story of how I came into control of more than 200 heavily…
170
Phishing attack against Lastpass
Updated 2016-02-04 : LastPass has removed the button from notifications and now requires email confirmation for all logins from new IPs . This substantially mitigates LostPass, but does not eliminate it.
171
StartSSL domain validation vulnerability
StartSSL certificate authority is well known for offering free domain validated SSL certificates, and also sells organisation and extended v...
172
The NSA Is Hoarding Vulnerabilities
The National Security Agency is lying to us. We know that because data stolen from an NSA server was dumped on the Internet. The agency is hoarding information about security vulnerabilities in the products you use, because it wants to use it to hack others’ computers. Those vulnerabilities aren’t being reported, and…
173
174
175
How the United Arab Emirates Intelligence Tried to Hire Me to Spy on Its People
Recently, we’ve been overwhelmed with news of horrors, attacks, monsters who murder the innocent in the name of a faith they don’t truly know. I’m publishing t…
176
The Untouchables – Apple’s new OS “activation” for Touch Bar MacBook Pros
Last week Joe Chilcote discovered an interesting message when imaging a Late 2016 MacBook Pro TouchBar (from here on out referred to as TBP): A critical software update is required for your Mac. To…
177
Hacking industrial vehicles from the internet
It is possible to monitor and control float trucks, public bus or delivery vans from the internet , obtaining their speed, position, and a lot other parameters. You can even control some parameters of the vehicle or hack into the canbus of the vehicle remotely.
178
179
On the modern web, ISPs are one of your threats (2015)
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
180
My Take on FBI's “Alternative” Method
FBI acknowledged today that there “appears” to be an alternative way into Farook’s iPhone 5c – something that experts have been shouting for weeks now; in fact, we’ve been saying there are several viable methods. Before I get into which method I think is being used here, here are some possibilities of other viable…