A vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to a buffer overflow in the affected code area. The…
Over the last day with the community's help we have crowdsourced a list of all of the major bugs with smart contracts on Ethereum so far, including both the...
The Internet of Things is the name given to the computerization of everything in our lives. Already you can buy Internet-enabled thermostats, light bulbs, refrigerators, and cars. Soon everything will be on the Internet: the things we own, the things we interact with in public, autonomous things that interact with…
By exploiting some peculiarities of the popular Web programming framework Ruby on Rails, MIT researchers have developed a system that can quickly comb through tens of thousands of lines of application code to find security flaws.
The community team is excited to announce the new Tor Browser User Manual! The manual is...
Some people change their SSH port on their servers so that it is slightly harder to find for bots or other nasties and while that is generally viewed as an action of security through obscurity it does work very well at killing a lot of the automated logins you always see in /var/log/auth.log .
Vulnerabilities discovered by Tyler Bohan of Cisco Talos. Many of the wide variety of file formats are designed for specialized uses within specific industries. Apple offers APIs as interfaces to provide a definitive way to access image data for multiple image formats on the Apple OS X platform. Talos is
Let me start with this headline [http://www.reuters.com/article/us-cyber-passwords-idUSKCN0XV1I6]: Other headlines went on to suggest that you need to change your password right now [http://www.iflscience.com/technology/millions-passwords-hotmail-gmail-and-yahoo-have-been-stolen] if you're using the likes
Few schemes for monetizing stolen credit cards are as bold as the fuel theft scam: Crooks embed skimming devices inside fuel station pumps to steal credit card data from customers. Thieves then clone the cards and use them to steal hundreds of gallons of gas at multiple filling stations. The gas is pumped into…
Mozilla has discovered that a Certificate Authority (CA) called WoSign has had a number of technical and management failures. Most seriously, we discovered they were backdating SSL certificates in order ...
The FBI's demand that Apple craft new software to bypass iOS's security protections has ignited a worldwide debate about a government's ability to force tech companies to sabotage their own security. One repeated question has been: will other countries, like China, demand the same powers? You don't...
The House Judiciary Committee has plans for a “members only” meeting next week to discuss Section 702 of the FISA Amendment Acts, the law the NSA relies on to operate its notorious PRISM surveillance program and to tap into the backbone of the Internet, also known as “upstream” collection. While we...
Rewriting the rulebook on coups, time to add cyberpower
Instagram leaves its users open to a simple phishing attack
I’ve been saying for years that it’s bad security advice, that it encourages poor passwords. Lorrie Cranor, now the FTC’s chief technologist, agrees: By studying the data, the researchers identified common techniques account holders used when they were required to change passwords. A password like “tarheels#1”, for…
Cross posting this. It was written a couple months ago and posted to Mozilla’s Security Blog This article was coauthored by Aislinn Grigas, Senior Interaction Designer, Firefox Desktop November 3, 2015 Over the past few months, Mozilla has been improving the user experience of our privacy and security features in…
Since the initial launch of Qubes OS back in April 2010, work on Qubes has been funded in several different ways. Originally a pet project, it was first supported by Invisible Things Lab (ITL) out of the money we earned on various R&D and consulting contracts. Later, we decided that...
1) Intro & Motivations At the start of of this year, I set myself a personal goal of finding 365 bugs in 365 days. This was entirely motivated by wanting to challenge myself to find more security issues as I felt I'd been slacking off. I thought back to things
HTTP Public Key Pinning (HPKP, RFC 7469)—a standard that was intended to bring public key pinning to the masses—might be dead.
Security has always been critical to the web, but challenges involved in site migration have inhibited HTTPS adoption for several years. In the interest of a safer web for all, at Google we've worked alongside many others across the online ecosystem to better understand and address these challenges, resulting in real…
I enjoy breaking websites.
This post grew out of a friend on Facebook asking (I paraphrase) "why do you spend your time on security instead of using your brainpower f...
A case study of a Chrome extension that turned out to be some nasty botnet malware.
Xinjiang, home of the China's muslim Uighur minority, has long been the world's laboratory for Internet repression. Faced with widespread local unrest, and online debate, China has done everything it can to enforce its vision of the Net in the region, from imprisoning bloggers and online publishers...
