241
Thoughts on the Systemd Root Exploit
Sebastian Krahmer of the SUSE Security Team has discovered a local root exploit in systemd v228 . A local user on a system running systemd v228 can escalate to root privileges. That's bad.
242
USPS ‘Informed Delivery’ Is Stalker’s Dream
A free new service from the U.S. Postal Service that provides scanned images of incoming mail before it is slated to arrive at its destination address is raising eyebrows among security experts who worry about the service’s potential for misuse by private investigators, identity thieves, stalkers or abusive…
243
244
Fingerprinting Firefox users with cached intermediate CA certificates
Fingerprinting Firefox users with cached intermediate CA certificates (#fiprinca) ...
245
246
Someone cloned my website and is using it to scam people
I was looking on the DuckDuckGo search results for "anonymous bitcoin sms" today, just to see what was out there. My SMS Privacy was the top result, as expected. But the second result was new to me:
247
Cracking random number generators (xoroshiro128+)
In software, we generate random numbers by calling a function called a "random number generator". Such functions have hidden states, so that repeated calls to the function generate new numbers that appear random. If you know this state, you can predict all future outcomes of the random number generators. O'Neill, a…
248
Anomalous keys in Tor relays
Counting almost 7,000 relays , the Tor network is one of the largest volunteer-run anonymity networks operating today. Most of the volunteers who operate these relays choose to remain anonymous, and little is known about how they set up or operate their relays. As a result, it is not clear if all relays correctly…
249
On Web Extensions shortcomings and their impact on add-on security
Recently, I reported a security issue in the new Firefox Screenshots feature (fixed in Firefox 56). This issue is remarkable for a number of reasons. First of all, the vulnerable code was running within the Web Extensions sandbox, meaning that it didn’t have full privileges like regular Firefox code. This code was…
250
Certified Malice
One unfortunate (albeit entirely predictable) consequence of making HTTPS certificates “fast, open, automated, and free” is that both good guys and bad guys alike will take advantage of the offer a…
251
Maybe we shouldn't skip SHA-3
David Wong writes about cryptography, security, and programming.
252
‘Carbon Dating’ the Internet Archive with OpenTimestamps
tl;dr: You can now use our searchable database to download Bitcoin timestamps for items in the Internet Archive.
253
Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards
Sonic Drive-In , a fast-food chain with nearly 3,600 locations across 45 U.S. states, has acknowledged a breach affecting an unknown number of store payment systems. The ongoing breach may have led to a fire sale on millions of stolen credit and debit card accounts that are now being peddled in shadowy underground…
254
255
Restic Cryptography
tl;dr: this is not an audit and I take no responsibility for your backups, but I had a quick look at the crypto and I think I’m going to use restic for my personal backups.
256
Unravelling Konami's Arcade DRM
It’s well known that Konami doesn’t have complex protection on its arcade systems. Programmed World was a fan-made network replacement and update service for Konami arcade games with no support outside of Japan. Nothing of its scale and quality had been seen before, and nothing has been seen since, despite other…
257
Remote code execution affecting most iOS/macOS apps
CVE-2017-2416 Remote code execution triggered by malformed GIF in ImageIO framework, affecting most iOS/macOS apps ImageIO Available for: iPhone 5 and later, iPad 4th generation and later, iPod tou…
258
Beyond public key encryption
One of the saddest and most fascinating things about applied cryptography is how little cryptography we actually use. This is not to say that cryptography isn’t widely used in industry —…
259
260
261
262
Why Security Backdoors are Bad (2016)
Recently, there has been a bit of controversy over the concept of the government or security agencies adding backdoors to services and…
263
A DoS Attack Against the C# Compiler
Generics in C# are certainly very useful and I find it amazing that we almost didn’t get them:
264
Patching Is Hard
There are many news reports of a ransomware worm . Much of the National Health Service in the UK has been hit; so has FedEx . The patch for the flaw exploited by this malware has been out for a while, but many companies haven’t installed it. Naturally, this has prompted a lot of victim-blaming: they should have…
265
Please Request Your Personal Data Held by Cambridge Analytica
By now, many people have probably heard about the company Cambridge Analytica . By its own admission, it played a major role in the succes...
266
WhatsApp Security Vulnerability
Back in March, Rolf Weber wrote about a potential vulnerability in the WhatsApp protocol that would allow Facebook to defeat perfect forward secrecy by forcibly change users’ keys, allowing it—or more likely, the government—to eavesdrop on encrypted messages. It seems that this vulnerability is real: WhatsApp has the…
267
The qmail security guarantee
Of course, ``security hole in qmail'' does not include problems outside of qmail: for example, NFS security problems, TCP/IP security problems, DNS security problems, bugs in scripts run from .forward files, and operating system bugs generally. It's silly to blame a problem on qmail if the system was already…
268
How The Intercept Outed Reality Winner
Today, The Intercept released documents on election tampering from an NSA leaker. Later, the arrest warrant request for an NSA contractor ...