1
2
What Happens When You Send a Zero-Day to a Bank?
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/how-to-zero-day-a-bank
3
Taking control of all .io domains with a targeted registration
A Hacker's Blog of Unintended Use and Insomnia.
4
US telcos appear to be selling non-anonymized access to consumer telephone data
https://bit.ly/crazymobiledemo
5
6
I Had My Electronics Seized by U.S. Customs and Border Protection
After my trip in Hamburg, Germany, for the 33rd Chaos Communication Congress, I left Germany for t
7
8
iOS Privacy: Easily get a user's Apple ID password, just by asking
I work with U.S. law firms as a non-testifying technical consulting expert on matters involving the Apple platform and iOS apps. Learn more about my litigation consulting.
9
Avoid Non-Microsoft Antivirus Software
Robert O'Callahan. Christian. Kiwi. Software guy. All content human-authored unless otherwise noted.
10
Tracking friends and strangers using WhatsApp
You and your good buddy, Steve Steveington, are in training for an arduous charity walk. You signed up together on the spur of the moment and pledged to hold each other accountable whilst you got in shape for the big day. However, you have developed reason to suspect that Steve Steveington is losing his commitment to…
11
12
Post a boarding pass on Facebook, get your account stolen
Article removed for legal reasons, sorry. After receiving a Czech version of a cease and desist letter from a legal representative of A. F., I've removed the article. You'll find articles based on my story in “Recommended reading” below, go read them.
13
14
Password Rules Are Bullshit
Of the many, many, many bad things about passwords, you know what the worst is? Password rules. Let this pledge be duly noted on the permanent record of the Internet. I don’t know if there’s an afterlife, but I’ll be finding out soon enough, and I plan
15
16
Dangers of CSV Injection
I’ve been doing the local usergroup circuit with this lately and have been asked to write it up.
17
Get your loved ones off Facebook
I originally wrote this for my friends and family in 2015, to explain why the latest Facebook privacy policy is really harmful. It’s since been read b
18
How Bank of America Gave Away My Money
TLDR: Bank of America is a horrible business and it should be ashamed by how bad it is. Two weeks ago, I suddenly received emails informing me that my Bank of America…
19
HTTPS on Your Landing Page Is Important
Occasionally, I feel like I'm just handing an organisation more shovels - "here, keep digging, I'm sure this'll work out just fine..." The latest such event was with NatWest [http://personal.natwest.com] (a bank in the UK), and it culminated with this tweet from them: > I'm
20
I'm Testifying to Congress about Data Breaches – What Should I Say?
Edit: I'm putting this up front as a lot of people are asking for it - the hearing will be live-streamed on YouTube and there's already an embedded video on the hearing page [https://energycommerce.house.gov/hearings/identity-verification-post-breach-world/] . There's a title I
21
Defending a website with Zip bombs
Personal Blog of Christian Haschek
22
23
Face ID, Touch ID, No ID, PINs and Pragmatic Security
I was wondering recently after poring through yet another data breach how many people actually use multi-step verification. I mean here we have a construct where even if the attacker has the victim's credentials, they're rendered useless once challenged for the authenticator code or SMS which is
24
Stupid security things
My mate Lars Klint shared this tweet the other day: > Your password is not unique. pic.twitter.com/ga4GwxtzrQ [https://t.co/ga4GwxtzrQ] — Lars Klint (@larsklint) April 16, 2017 [https://twitter.com/larsklint/status/853507749488975873] Naturally, I passed it on [https://twitter.com/troyhunt/status/853517036131041280]…
25
Something is wrong when the ‘telephone app’ on your phone becomes 3rd party
Since I am not living in my home country, I frequently use two different SIM cards and prefer having a phone with dual-sim support. This limits your choice s...
26
Inside a low-budget consumer hardware espionage implant
The following analysis was performed on a S8 data line locator which replied to the hidden SMS command for version query ( *3646655* ) with:
27
Call of Duty gaming community points to ‘swatting’ in Wichita police shooting
A 28-year-old Kansas man was shot and killed by police officers on the evening of Dec. 28 after someone fraudulently reported a hostage situation ongoing at his home. The false report was the latest in a dangerous hoax known as “ swatting ,” wherein the perpetrator falsely reports a dangerous situation at an address…
28
HTTPS on Stack Overflow: The End of a Long Road
Today, we deployed HTTPS by default on Stack Overflow. All traffic is now redirected to https:// and Google links will change over the next few weeks. The ac...
29
The Line of Death
When building applications that display untrusted content, security designers have a major problem— if an attacker has full control of a block of pixels, he can make those pixels look like anything…
30
How the Bitcoins Were Stolen from Mt. Gox [video]
The thought “I know PHP! How hard could running an exchange be?” never goes anywhere good.