361
362
StartSSL domain validation vulnerability
StartSSL certificate authority is well known for offering free domain validated SSL certificates, and also sells organisation and extended v...
363
Qubes OS 3.1 has been released
I’m happy to announce that today we’re releasing Qubes OS 3.1! The major new architectural feature of this release has been the introduction of the Qubes Management infrastructure, which is based on the popular Salt management software. In Qubes 3.1, this management stack makes it possi...
364
The NSA Is Hoarding Vulnerabilities
The National Security Agency is lying to us. We know that because data stolen from an NSA server was dumped on the Internet. The agency is hoarding information about security vulnerabilities in the products you use, because it wants to use it to hack others’ computers. Those vulnerabilities aren’t being reported, and…
365
366
iOS 10 to Feature Stronger “Limit Ad Tracking” Control
The release of iOS 10, the newest version of Apple's mobile operating system (coming this Fall), will bring an array of new features and upgrades, and a change to the functionality of the "Limit Ad Tracking" privacy setting.
367
DDoSCoin: Cryptocurrency with malicious proof of work
Eric Wustrow, University of Colorado Boulder; Benjamin VanderSloot, University of Michigan
368
369
How the United Arab Emirates Intelligence Tried to Hire Me to Spy on Its People
Recently, we’ve been overwhelmed with news of horrors, attacks, monsters who murder the innocent in the name of a faith they don’t truly know. I’m publishing t…
370
The Untouchables – Apple’s new OS “activation” for Touch Bar MacBook Pros
Last week Joe Chilcote discovered an interesting message when imaging a Late 2016 MacBook Pro TouchBar (from here on out referred to as TBP): A critical software update is required for your Mac. To…
371
Hacking industrial vehicles from the internet
It is possible to monitor and control float trucks, public bus or delivery vans from the internet , obtaining their speed, position, and a lot other parameters. You can even control some parameters of the vehicle or hack into the canbus of the vehicle remotely.
372
373
World of Warcraft: one simple line of code can cost you dearly
A few days ago, a new type of gold/item scam made the rounds. Usually scamming in MMORPGs is done using social engineering techniques, e.g. an attacker sells a fake item code for alleged in-game items like mounts to a potential victim for in-game currency. But this most recent kind of attack does not only involve…
374
How we found a bug in Amazon ELB
Troubleshooting of an Amazon ELB bug found in production using the Sysdig and Wireshark analysis tools and following a strictly top-down approach.
375
376
On the modern web, ISPs are one of your threats (2015)
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
377
My Take on FBI's “Alternative” Method
FBI acknowledged today that there “appears” to be an alternative way into Farook’s iPhone 5c – something that experts have been shouting for weeks now; in fact, we’ve been saying there are several viable methods. Before I get into which method I think is being used here, here are some possibilities of other viable…
378
379
Attack of the Week: Apple iMessage
Today’s Washington Post has a story entitled “Johns Hopkins researchers poke a hole in Apple’s encryption”, which describes the results of some research my students and I have bee…
380
Mission Improbable: Hardening Android for Security and Privacy
Updates: See the Changes section for a list of changes since initial posting. After a long wait,...
381
382
383
384
385
Reverse engineering and removing Pokémon GO’s certificate pinning
A deep dive into Pokémon GO’s certificate pinning.
386
JetBrains IDE Remote Code Execution and Local File Disclosure
TL;DR From at least 2013 until May 2016 JetBrains' IDEs were vulnerable to local file leakage, with the Windows (EDIT: and OS X) versions …
387
Arguments Supporting Warrantless Surveillance Wither When Exposed to Sunlight
The government recently declassified a secret letter, written in 2002 laying out the executive branch’s initial legal justifications for the vast expansion of electronic surveillance after September 11, 2001. Like many others, it was written by former DOJ Office of Legal Counsel attorney John Yoo,...
388
389
Lessons learned while protecting Gmail
Posted by Elie Bursztein - anti-abuse & security research, Nicolas Lidzborski - Gmail security engineering, and Vijay Eranti - Gmail anti-abus...
390
How I found a data leak of a company during a college lecture
A few weeks ago I gave a guest lecture at the Windesheim University of Applied Sciences in The Netherlands. Being a Windesheim graduate myself I’ve always kept in touch with my former teachers. One of them told me recently that a lot of students want to learn more about IT security & hacking and invited me to give a…