451
Yubico announces tiny, cheap YubiHSM 2
Learn more about what's happening within the tech and cybersecurity industry and the developments in our business and security keys within our Yubico Blog.
452
453
Cryptographic vulnerabilities in IOTA
Last month, Ethan Heilman, Tadge Dryja, Madars Virza, and I took a look at IOTA, currently the 8th largest cryptocurrency with a $1.9B…
454
Netstat without netstat
Recently I was doing an assessment in a locked down and restricted environment. One of the first actions you tend to do when landing a shell on a [linux] box is to do some reconnaissance. This is both on host and network, as you want to determine what new access this host has given you. Normally you would run netstat…
455
Who moved my cheese, 1Password?
For the impatient, feel free to skip to the TL;DR summary.
456
Reading Uber’s Internal Emails: Bug Bounty report worth $10K
Find bugs faster with ScanSearch. Discover forgotten assets, shadow IT, and expanded attack surfaces for bug bounty hunting.
457
A very casual introduction to Fully Homomorphic Encryption (2012)
Craig Gentry on board the mothership. (credit) A couple of weeks ago I polled readers for the subjects that they were interested in. You gave me some excellent responses, and I promise they’r…
458
Cloudflare Reports Massive Slowdown in Network Level DDoS Attacks
News outlets and blogs will frequently compare DDoS attacks by the volume of traffic that a victim receives. Surely this makes some sense, right? The greater the volume of traffic a victim receives, the harder to mitigate an attack - right?
459
460
I cannot consistently write safe C/C++ code
Robert O'Callahan. Christian. Kiwi. Software guy. All content human-authored unless otherwise noted.
461
PGP needs to be retired in honor
personal ramblings, noone cares about
462
Rediscovering the Intel AMT Vulnerability
On May 1, 2017 Intel disclosed the AMT vulnerability (INTEL-SA-00075), but details of that vulnerability were not made public. However, Tenable researchers were able to overcome this challenge and make Tenable the first to deliver Intel AMT vulnerability detection capabilities to customers, just minutes after Intel’s…
463
464
How Stack Overflow plans to survive the next DNS attack
Let’s talk about DNS. After all, what could go wrong? It’s just cache invalidation and naming things .
465
Aadhaar isn’t progress – it’s dystopian and dangerous
Mitchell Baker and Ankit Gadgil: India should pause further roll out of Aadhaar until a law protecting individual security is passed.
466
467
Learning with Privacy at Scale
Understanding how people use their devices often helps in improving the user experience. However, accessing the data that provides such…
468
OSS-Fuzz: Five months later, and rewarding projects
The latest news from Google on open source releases, major projects, events, and outreach programs for early career developers.
469
How Dirty COW works from the Linux kernel’s perspective
Dirty COW (CVE-2016-5195) is one of the most publicised local privilege escalation vulnerabilities in 2016, courtesy to its catchy name, cute logo, potential damages, and the fact that it was discovered in the wild by a researcher Phil Oester, meaning it was already under active use at the time of discovery.
470
Shadow Brokers exploits are patched or inactive on supported Windows platforms
Today, Microsoft triaged a large release of exploits made publicly available by Shadow Brokers. Understandingly, customers have expressed concerns around the risk this disclosure potentially creates. Our engineers have investigated the disclosed exploits, and most of the exploits are already patched. Below is our…
471
HTTPS adoption has reached the tipping point
That's it - I'm calling it - HTTPS adoption has now reached the moment of critical mass [https://en.wikipedia.org/wiki/The_Tipping_Point] where it's gathering enough momentum that it will very shortly become "the norm" rather than the exception it so frequently was in the past.
472
Further hardening glibc malloc() against single byte overflows
Introduction Back in 2014, while at Project Zero, I exploited a buffer overflow of a single NUL byte in glibc . Tavis Ormandy had found th...
473
474
Blueborne – A new attack vector endangering major operating systems
Following the disclosure of the BlueBorne attack vector this past September, Armis discovered that critical Bluetooth vulnerabilities impact the Amazon Echo and Google Home.
475
Mastercard Internet Gateway Service: Hashing Design Flaw
Last year I found a design error in the MD5 version of the hashing method used by Mastercard Internet Gateway Service. The flaw allows modification of transaction amount. They have awarded me with a bounty for reporting it. This year, they have switched to HMAC-SHA256, but this one also has a flaw
476
Understanding the “GPL is a Contract” court case
There's been a lot of confusion about the recent Artifex v. Hancom case, in which the court found that the GPL was an enforceable contract. I'm going to try to explain the whole thing in clear terms for the legal layman.
477
478
479
480
Playing with Kernel TLS in Linux 4.13 and Go
The 1600 LoC patch allows userspace to pass the kernel the encryption keys for an established connection, making encryption happen transparently inside the kernel.