151
The strange story of “Extended Random”
Yesterday, David Benjamin posted a pretty esoteric note on the IETF’s TLS mailing list. At a superficial level, the post describes some seizure-inducingly boring flaws in older Canon printers…
152
Secure Computing for Journalists
This morning on Twitter, Buzzfeed editor Miriam Elder asks the following question: Possibly stupid question: is the Signal desktop client as secure as the mobile app? — Miriam Elder (@MiriamElder) …
153
154
Disqus Demonstrates How to Do Breach Disclosure Right
We all jumped on "the Equifax dumpster fire bandwagon" recently and pointed to all the things that went fundamentally wrong with their disclosure process. But it's equally important that we acknowledge exemplary handling of data breaches when they occur because that's behaviour that should be encouraged. Last week,
155
Bypassing Browser Security Warnings with Pseudo Password Fields
It seems that there is no limit to human ingenuity when it comes to working around limitations within one's environment. For example, imagine you genuinely wanted to run a device requiring mains power in the centre of your inflatable pool - you're flat out of luck, right? Wrong! Or
156
Mac OS High Sierra automatically checks EFI firmware each week
Every week, Macs running High Sierra will check the integrity of their EFI firmware, in a bid to detect tampering by malware.
157
Decoding an air conditioner control's checksum with differential cryptanalysis
Back in 2009 I wrote an Arduino library ( IRRemote ) to encode and decode infrared signals for remote controls. I got an email recently fr...
158
159
Why Is the TSA Scanning Paper?
I’ve been reading a bunch of anecdotal reports that the TSA is starting to scan paper separately: A passenger going through security at Kansas City International Airport (MCI) recently was asked by security officers to remove all paper products from his bag. Everything from books to Post-It Notes, documents and more…
160
Experian Site Can Give Anyone Your Credit Freeze PIN
An alert reader recently pointed my attention to a free online service offered by big-three credit bureau Experian that allows anyone to request the personal identification number (PIN) needed to unlock a consumer credit file that was previously frozen at Experian.
161
Who controls your computer? and how to make sure it's you
Can you trust your computer? Can you control what it does and doesn’t? Or is someone else in control? How can you even know what it is or isn’t doing? Even if it tells you, how do you know it’s not lying? As computing systems become more complex, how can “Trusted Computing” be achieved, not (just) by big corporations…
162
Getting Hacked, Lessons Learned
I read Cody Brown’s blog post about getting hacked on Thursday of last week. I feel very badly for Cody and plan to send him some BTC once I get access back to my account. His post helped me avoid his fate. I woke up Friday morning (central european summer time) and saw a bunch […]
163
164
Fuzzing is magic – Or how I found a panic in Rust's regex library
Going through the steps of using cargo fuzz to find bugs in Rust projects
165
166
167
168
Password reuse and credential stuffing
The short version: I'm loading over 1 billion breached accounts into HIBP. These are from 2 different "combo lists", collections of email addresses and passwords from all sorts of different locations. I've verified their accuracy (including my own record in one of them) and many hundreds of millions
169
170
Debugging macOS Kernel Using VirtualBox
Update: In the HN discussion, awalton mentioned you can set CPUID flags in VMWare. Simply adding cpuid.7.ebx = "-----------0--------------------" to the vmx file will disable SMAP. Late last year, I upgraded my old MBP to the 2016 model with a Skylake processor. As I was debugging a kernel exploit, it turned out that…
171
172
Decrypting Amber Rudd
1 Aug, 2017 Facebook, Microsoft, Twitter, and YouTube (Google/Alphabet, Inc) have formed the Global Internet Forum to Counter Terrorism and Amber Rudd is asking them to quietly drop end-to-end encryption from their products. You should not believe a single word any of those companies tells you about end-to-end…
173
OneLogin: Breach Exposed Ability to Decrypt Data
OneLogin , an online service that lets users manage logins to sites and apps from a single platform, says it has suffered a security breach in which customer data was compromised, including the ability to decrypt encrypted data.
174
OpenSSH Keys: A Walkthrough
Photography and long-form writing on my life, technology, photography, philosophy, books, and whatever else strikes my fancy.
175
On the Perceived Value of EV Certs, Commercial CAs, Phishing and Let's Encrypt
Last week I wrote about how Life Is About to Get a Whole Lot Harder for Websites Without HTTPS [https://www.troyhunt.com/life-is-about-to-get-harder-for-websites-without-https/]. Somewhere in the comments there, the discussion went off on a tangent about commercial CAs, the threat
176
The Trouble with Politicians Sharing Passwords
Yesterday I had a bunch of people point me at a tweet from a politician in the UK named Nadine Dorries [https://twitter.com/NadineDorries]. As it turns out, some folks were rather alarmed about her position on sharing what we would normally consider to be a secret. In this
177
178
179
Please Stop Writing Secure Messaging Tools (2015)
This is my first Patreon-supported essay, which went out a week early to my $10 and up subscribers. This was written in part in response to issues with the IWMF check-in tool, but it's something I've been concerned about for some time.
180
Testing FIDO U2F security keys
Last time I reviewed various security keys at a fairly superficial level: basic function, physical characteristics etc. This post considers lower-level behaviour.