New EFF Report Maps Legal Threats to Free Expression in the Arab WorldFreedom of expression is a universal right, but the specific threats to it vary widely from country to country and region to region. As activists fighting for free speech worldwide, it is essential that we better understand the...
To help users browse the web safely, Chrome indicates connection security with an icon in the address bar. Historically, Chrome has not exp...
This post is about a Man in the Middle (MitM) vulnerability in KeePass 2’s automatic update check. KeePass – the free and open source password manager – uses, in all versions up to the current 2.33, unencrypted HTTP requests to check for new software versions. An attacker can abuse this automatic update check – if…
Survival in an Extremely Adversarial Environment If your secure communications platform isn’t being used by terrorists and pedophiles, you&# …
This blog post shows how to create a reliable and realistic-looking malicious USB key that can be used in a drop attack.
The title kind of says it all. How do I know? Because of this photo : That's a picture of the logic board of an iPhone 5C, the same mod...
Until just last week, the U.S. government kept up the charade that its use of a stockpile of security vulnerabilities for hacking was a closely held secret.[fn]For what it's worth, the government denies having a “Raiders of the Lost Ark style” stockpile of zero days.[/fn] In fact, in response to...
Usual Mandatory Disclaimer: IANAC (I am not a cryptographer) so I might likely end up writing a bunch of mistakes in this blog post... ...
I decided to look into non-alphanumeric JavaScript again and see if it was possible to execute it without parenthesis. A few years ago I did a presentation on non-alpha code if you want some more info
This’s time to keep my word and here’re the docs I promised you. It’s not a report in one file, it’s a big folder of docs devoted to Hillary Clinton that I found on the DNC …
Most people think bitcoin is anonymous. In fact, new technologies trace BTC transactions, attempting to identify bitcoin users.
7-Zip vulnerabilities were discovered by Marcin Noga. Update 2016-05-12: Related advisories for the 7-Zip issues covered in this blog can be found here: http://www.talosintel.com/reports/TALOS-2016-0093/ http://www.talosintel.com/reports/TALOS-2016-0094/ 7-Zip is an open-source file
At SSL Labs, we have a major review of our grading criteria about once a year. As the security of the ecosystem matures, our goal is to push forward and make the requirements [for a good grade]…
I’m happy to announce that today we’re releasing Qubes OS 3.2! This is an incremental improvement over the 3.1 version that we released earlier this year. A lot of work went into making this release more polished, more stable and easier to use than our previous releases. One major featu...
At Heroku, we want to make it easy for everyone to be able to learn and explore our service, and the related ecosystem of technologies, for free - be it...
A multifunctional self-replicating Trojan for Linux written in Go. The Trojan implements the ВРЕ protocol to share data with other P2P botnet’s nodes and is launched as a node that receives and processes RPC messages. Probably, this malware program’s modification is still under development because ...
Dmitry.GR: Full sources for Android on zWatch
I think one of the biggest challenge for system engineers is designing security. Recently, at the 32c3 conference, plutoo, derrek, and smea presented a series of hacks that completely defeated the security of the 3DS. As a result, people have implemented boot-time unsigned code execution (called “arm9loaderhax” in the…
I’m writing a book on security in the highly connected Internet-of-Things world. Tentative title: Click Here to Kill Everybody Peril and Promise in a Hyper-Connected World There are two underlying metaphors in the book. The first is what I have called the World-Sized Web, which is that combination of mobile, cloud…
Security protocols often assume an accurate, local clock (e.g. TLS, Kerberos, DNSSEC and more). It's a widely accepted assumption when designing protocols but, for a lot of people, it just isn't true. We find good evidence that at least 25% of all certificate errors in Chrome are due to a bad local clock.
EFF and over a dozen other organizations are urging U.S. lawmakers to oppose a dangerous bill proposed by Sens. Sheldon Whitehouse and Lindsey Graham that would make the already-flawed Computer Fraud and Abuse Act (CFAA) worse. The joint letter sent Wednesday explains that the legislation fails to...
Distributed Denial of Service (DDoS) attempts to make a machine or network unavailable by flooding it with overwhelming amounts of traffic.
A team of Yale researchers has unveiled CertiKOS, the world’s first operating system that runs on multi-core processors and shields against cyber attacks.
I enjoy breaking websites.
