511
TunnelBear Publishes Security Audit
TunnelBear works with Cure53 to complete consumer VPN industry's first public security audit.
512
Exploiting Windows 10 in a Local Network with WPAD/PAC and JScript
by Ivan Fratric, Thomas Dullien, James Forshaw and Steven VittitoeIntroMany widely-deployed techn...
513
514
Patching is hard; so what?
It’s now been about a week since Equifax announced the record-breaking breach that affected 143 million Americans. We still don’t know enough — but a few details have begun to com…
515
A Sampling of Anti-Decompilation Techniques
Traditional (assembly level) reverse engineering of software is a tedious process that has been made far more accessible by modern day decompilers. Operating...
516
Hardening C/C++ Programs – Executable-Space Protection and ASLR
In the first part of this series we discussed the mechanics of an exploit, the general concept of hardening, and the stack protector hardening technique in particular. Some of the concepts explained there will be
517
Regarding Marcus Hutchins aka MalwareTech
Brief background
518
Reasonably Secure Computing in the Decentralized World
Joanna Rutkowska recently gave a presentation titled “Reasonably Secure Computing in the Decentralized World (An Operating System Architect’s Perspective)” at a public event hosted by The Golem Project in Berlin, Germany called “Golem and Friends: Data, Security, Scaling and More….” The...
519
California Legislature Sells Out Our Data to ISPs
In the dead of night, the California Legislature shelved legislation that would have protected every Internet user in the state from having their data collected and sold by ISPs without their permission. By failing to pass A.B. 375, the legislature demonstrated that they put the profits of Verizon...
520
Statement concerning the arrest of Dmitry Bogatov
[09 Dec 2017] Updated Debian 8: 8.10 released [09 Dec 2017] Updated Debian 9: 9.3 released [07 Oct 2017] Updated Debian 9: 9.2 released [12 Aug 2017] DebConf17 closes in Montreal and DebConf18 dates announced [22 Jul 2017] Updated Debian 9: 9.1 released [22 Jul 2017] Updated Debian 8: 8.9 released [18 Jun 2017] Debian…
521
Blocking Top-Level Navigations to Data URLs for Firefox 58
End users rely on the address bar of a web browser to identify what web page they are on. However, most end users are not aware of the concept of ...
522
523
Why Constant-Time Crypto?
In 1996, Paul Kocher published a novel attack on RSA, specifically on RSA implementations , that extracted information on the private key by simply measuring the time taken by the private key operation on various inputs. It took a few years for people to accept the idea that such attacks were practical and could be…
524
525
LastPass’ Authenticator app is not secure
An easy, root-free way to bypass fingerprint protection on LastPass’ authenticator app
526
527
Njalla – A privacy-aware domain registration service
FOR IMMACULATE RELEASE. Announcing the opening of NJAL.LA
528
Riseup moves to encrypted email in response to legal requests
After exhausting our legal options, Riseup recently chose to comply with two sealed warrants from the FBI, rather than facing contempt of court (which would have resulted in jail time for Riseup birds and/or termination of the Riseup organization). The first concerned the public contact address for an international…
529
The Great DOM Fuzz-Off of 2017
Posted by Ivan Fratric, Project ZeroIntroductionHistorically, DOM engines have been one of the la...
530
531
532
Android vulnerability allows attackers to modify apps
The CVE-2017-13156 bug in Android allows attackers to modify the code in applications without affecting their signatures. Learn more about Janus Vulnerability.
533
Incident report on memory leak caused by Cloudflare parser bug
Last Friday, Tavis Ormandy from Google’s Project Zero contacted Cloudflare to report a security problem with our edge servers. He was seeing corrupted web pages being returned by some HTTP requests run through Cloudflare.
534
535
Introducing App Engine Firewall
A key security feature for application developers and administrators is to be able to allow or deny incoming requests based on source IP addresses. This capability can help you do production testing without exposing your app to the world, block access to your app from specific geographies or block requests from a…
536
Cryptographically Secure PHP Development
Your field guide to building secure cryptography features in PHP
537
Serverless security implications from infra to OWASP
By its very nature, Serverless (FaaS) addresses some of today’s biggest security concerns but it doesn’t fix it all. This post outlines the top areas where Serverless helps or hinders our security efforts, offering advice on how to address concerns and thoughts on what’s to come next.
538
Cracking the 12+ Character Password Barrier, Literally
Password cracking rigs, red/blue team guides, and operator field notes from netmux.
539
Where the Apple accounts that hackers are threatening to wipe came from
The tech news recently has seen quite a lot of chatter about an alleged haul of Apple credentials [http://www.zdnet.com/article/apple-icloud-ransom-what-you-need-to-know/], apparently about 250 million of them in all. Allegedly. Maybe. Or was it 300 million? [https://www.macrumors.com/
540
Thai activist jailed under lese majeste laws for sharing an article on Facebook
Thai activist Jatuphat “Pai” Boonpattaraksa was sentenced this week to two and a half years in prison—for the crime of sharing a BBC article on Facebook. The Thai-language article profiled Thailand’s new king and, while thousands of users shared it, only Jutaphat was found to violate Thailand’s...