301
302
303
304
Chrome to force .dev domains to HTTPS via preloaded HSTS
Google bought the .dev gTLD and Chrome 63 started force-redirecting every .dev domain to HTTPS via preloaded HSTS, breaking local dev setups. Here's why, and …
305
Unikernels are secure
Per Buer is the CEO of IncludeOS . IncludeOS is a clean-slate unikernel written in C++ with performance and security in mind. Per Buer is the founder and previous CEO/CTO of Varnish Software.
306
307
Dutch Data Protection Authority: Microsoft breaches law with Windows 10
Met deze test controleren we of u een mens bent. Hiermee voorkomen we ongeoorloofd gebruik van deze dienst.
308
Sinking container ships by hacking load plan software
In my previous article, we looked at the easiest route on to a ships network – the satcoms system. Even having compromised that, it could be a challenge to affect the ship’s navigation, propulsion and control systems – most of these networks are at least somewhat segregated from one another. That got me thinking about…
309
Disqus comments adding third-party ad-tracking
I'm killing Disqus comments on my blog. Here's why.
310
Why TLS 1.3 isn't in browsers yet
Upgrading a security protocol in an ecosystem as complex as the Internet is difficult. You need to update clients and servers and make sure everything in between continues to work correctly. The Internet is in the middle of such an upgrade right now.
311
EFF’s “Spying on Students” Report Highlights Tech Companies’ Data Collection
San Francisco—School children are being spied on by tech companies through devices and software used in classrooms that often collect and store kids’ names, birth dates, browsing histories, location data, and much more—often without adequate privacy protections or the awareness and consent of...
312
Class Breaks
There’s a concept from computer security known as a class break. It’s a particular security vulnerability that breaks not just one system, but an entire class of systems. Examples might be a vulnerability in a particular operating system that allows an attacker to take remote control of every computer that runs on…
313
Multiple vulnerabilities in RubyGems
There are multiple vulnerabilities in RubyGems bundled by Ruby.It is reported at the official blog of RubyGems.
314
315
316
How the NSA obtains and uses airline reservations (2013)
A front-page report in today’s New York Times based on documents leaked by NSA whistleblower Edward Snowden confirms that the NSA, like the DHS, uses airline reservation data as part of its profiling and social network analysis of US citizens and foreigners. Today’s report also raises new questions, and suggests some…
317
Exploiting the Wi-Fi Stack on Apple Devices
Posted by Gal Beniamini, Project ZeroEarlier this year we performed research into Broadcom’...
318
319
A Detailed Elliptic Curve Cryptography Tutorial
When adding two integers i and j of bitlength b, the result will be of bitlength b + 1 in the worst case. This means they can easily be naively added. If the result is larger or equal to F p one has only to subtract p from the result, i.e.:
320
How I snatched 153k Ether after a bad Tinder date
Over the weekend, I did a lot of swiping right. I’ve never had a Tinder go this fast from match to agreeing on a date time this fast…
321
TLS 1.2 Session Tickets
Session Tickets, specified in RFC 5077 , are a technique to resume TLS sessions by storing key material encrypted on the clients. In TLS 1.2 they speed up the handshake from two to one round-trips.
322
How Torch broke ls and made me vulnerable
If used incorrectly, LD_LIBRARY_PATH can cause a plethora of issues
323
Finding Ticketbleed
Ticketbleed (CVE-2016-9244) is a software vulnerability in the TLS stack of certain F5 products that allows a remote attacker to extract up to 31 bytes of uninitialized memory at a time, which can contain any kind of random sensitive information, like in Heartbleed.
324
325
Dutch House of Representatives passes dragnet surveillance bill
On February 14, 2017 the bill for the new Intelligence and Security Services Act was passed by the Dutch lower house. Despite being met with serious opposition from experts, regulators, civil society, political parties and citizens, the revised bill passed virtually unchanged from the proposal submi
326
How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern
In April of 2016 Etsy launched Pattern, a new product that gives Etsy sellers the ability to create their own hosted e-commerce...
327
Signal intelligence 101: SIGINT targets
A quick overview of the various types of signal intelligence targets, with an emphasis on the Soviet Cold War systems
328
329
Using Binary Diffing to Discover Windows Kernel Memory Disclosure Bugs
Posted by Mateusz Jurczyk of Google Project ZeroPatch diffing is a common technique of comparing ...
330
An Ancient Kernel Hole Is Not Closed
The "stack clash" series of vulnerabilities were a prime opportunity to demonstrate the strength of grsecurity's approach to security. Unlike upstream Linux and other OSes, the issues uncovered were unexploitable under grsecurity for many years.