181
182
‘Honeypot’ pages to try to convert people searching for cracked software
Software piracy is a fact of life for vendors of desktop software. Take a look at Google’s helpful suggestions if you search on the name of one of my products: Trying to make your software cr…
183
184
DHS Quietly Testing Mandatory Facial Recognition of Passengers Exiting U.S
We’re all used to having to identify ourselves as we enter a country. It is the only way we can hope to have any attempt at a secure border. But, so-called “exit controls,” wher…
185
Removing Edge Magazine DRM
Edge Magazine is one of the oldest gaming magazines in the world. It is famous for the quality of its reviews, all of which were available online up until a few years ago, when their website was closed. The magazine continued its life in print and digital subscription format only. I really liked the content they…
186
Dear Obama, from Infosec
Dear President Obama: We are more than willing to believe Russia was responsible for the hacked emails/records that influenced our electio...
187
188
189
190
Why So Many Top Hackers Hail from Russia
Conventional wisdom says one reason so many hackers seem to hail from Russia and parts of the former Soviet Union is that these countries have traditionally placed a much greater emphasis than educational institutions in the West on teaching information technology in middle and high schools, and yet they lack a…
191
192
Obscurity Is a Valid Security Layer
Good Obscurity vs. Bad Obscurity Camouflage OPSEC An SSH Example Reducing Impact or Probability Summary Many of us are familiar with a concept know as Security
193
Zero-knowledge proofs, Zcash, and Ethereum
Part 3 of a series on “Privacy on the Blockchain”.
194
The Ethics of Running a Data Breach Search Service
No matter how much anyone tries to sugar coat it, a service like Have I been pwned [https://haveibeenpwned.com/] (HIBP) which deals with billions of records hacked out of other peoples' systems is always going to sit in a grey area. There are degrees, of course; at one end
195
Myspace lets you hijack any account just by knowing the person’s birthday
In April this year whilst roaming the plains of the wild world web, I stumbled across an old Myspace account of mine. Attempting to gain access and delete the account I discovered a business process so flawed it deserves its own place in history. I wrote to Myspace describing my
196
Equifax or Equiphish?
More than a week after it said most people would be eligible to enroll in a free year of its TrustedID identity theft monitoring service, big three consumer credit bureau Equifax has begun sending out email notifications to people who were able to take the company up on its offer. But in yet another security stumble…
197
Look before you paste from a website to terminal
All about making life easier and efficient with Linux
198
Weaponizing PostScript
In a recent pentesting assignment, there was a service which converted uploaded files to PDF/A format, to make them safer for handling. Afte...
199
Cracking Encrypted PDFs
I performed a brute-force attack on the password of an encrypted PDF and a brute-force attack on the key of (another) encrypted PDF, both PDFs are part of a challenge published by John August. The …
200
Attack of the week: DUHK
Before we get started, fair warning: this is going to be a post about a fairly absurd (but non-trivial!) attack on cryptographic systems. But that’s ok, because it’s based on a fairly a…
201
Cryptographic vulnerabilities in IOTA
Last month, Ethan Heilman, Tadge Dryja, Madars Virza, and I took a look at IOTA, currently the 8th largest cryptocurrency with a $1.9B…
202
Netstat without netstat
Recently I was doing an assessment in a locked down and restricted environment. One of the first actions you tend to do when landing a shell on a [linux] box is to do some reconnaissance. This is both on host and network, as you want to determine what new access this host has given you. Normally you would run netstat…
203
Who moved my cheese, 1Password?
For the impatient, feel free to skip to the TL;DR summary.
204
Reading Uber’s Internal Emails: Bug Bounty report worth $10K
Find bugs faster with ScanSearch. Discover forgotten assets, shadow IT, and expanded attack surfaces for bug bounty hunting.
205
A very casual introduction to Fully Homomorphic Encryption (2012)
Craig Gentry on board the mothership. (credit) A couple of weeks ago I polled readers for the subjects that they were interested in. You gave me some excellent responses, and I promise they’r…
206
207
I cannot consistently write safe C/C++ code
Robert O'Callahan. Christian. Kiwi. Software guy. All content human-authored unless otherwise noted.
208
PGP needs to be retired in honor
personal ramblings, noone cares about
209
How Dirty COW works from the Linux kernel’s perspective
Dirty COW (CVE-2016-5195) is one of the most publicised local privilege escalation vulnerabilities in 2016, courtesy to its catchy name, cute logo, potential damages, and the fact that it was discovered in the wild by a researcher Phil Oester, meaning it was already under active use at the time of discovery.
210
HTTPS adoption has reached the tipping point
That's it - I'm calling it - HTTPS adoption has now reached the moment of critical mass [https://en.wikipedia.org/wiki/The_Tipping_Point] where it's gathering enough momentum that it will very shortly become "the norm" rather than the exception it so frequently was in the past.