241
GitHub shouldn't allow username reuse
Update 2018-04-19 - GitHub has implemented some rules around retiring "namespaces".
242
What’s Hiding in Your PDF?
PDFs hold information you may not know about. Discover different forms of metadata and where to look for them.
243
Apple in China: who holds the keys?
Last week Apple made an announcement describing changes to the iCloud service for users residing in mainland China. Beginning on February 28th, all users who have specified China as their country/r…
244
Simple Encrypted Arithmetic Library goes open source
Today we are extremely excited to announce that our Microsoft Simple Encrypted Arithmetic Library (Microsoft SEAL), an easy-to-use homomorphic encryption library developed by researchers in the Cryptography Research group at Microsoft, is open source on GitHub under an MIT License for free use. The library has already…
245
Major sites running unauthenticated JavaScript on their payment pages
A few months ago, British Airways' customers had their credit card details stolen. How was this possible? The best guess goes something like this: BA had 3rd party JS on its payment page <script src="https://example.com/whatever.js"></script> The 3rd party's site was hacked, and the JS was changed. BA's customers ran…
246
Secure Access to 100 AWS Accounts
Explore technical topics, solutions, and resources for building with Twilio – and beyond.
247
Why [Insert Thing Here] Is Not a Password Killer
These days, I get a lot of messages from people on security related things. Often it's related to data breaches or sloppy behaviour on behalf of some online service playing fast and loose with HTTPS or passwords or some other easily observable security posture. But on a fairly regular
248
Shamir’s Secret Sharing Scheme
Consider a scenario in which you are tasked with managing the security of a bank's vault. The vault is considered impenetrable without a key, which you are g...
249
Binary SMS – The old backdoor to your new thing
A Accenture oferece oportunidades que surgem a partir da disrupção tecnológica em todas as indústrias, em todos os países, todos os dias. Saiba mais!
250
Why Intel will never let owners control the ME
The Intel Management Engine is an auxillary microprocessor embedded into modern Intel x86 CPUs or chipsets. 1 It runs an Intel-signed proprietary binary blob. Due to code signing restrictions enforced by the hardware, it cannot be modified or replaced by the user. (AMD x86 CPUs have a similar auxillary microprocessor…
251
Money Laundering via Author Impersonation on Amazon
Patrick Reames had no idea why Amazon.com sent him a 1099 form saying he’d made almost $24,000 selling books via Createspace , the company’s on-demand publishing arm. That is, until he searched the site for his name and discovered someone has been using it to peddle a $555 book that’s full of nothing but gibberish.
252
Court has confirmed coordinated raids of Zwiebelfreunde in Germany were illegal
Update July 10th: Last week Monday, prosecution stated that they will keep our things for further analysis, even after explicitly confirming to journalists that they are aware that our only connection to Riseup is the collection of donations. This includes items belonging to our partners, and other third parties like…
253
254
Advanced web security topics
(Updated 22 May 2020) This post discusses web security issues that I come across – so far thankfully mostly by reading about them. It is a work in progress which I’ll keep updating. The…
255
Secret Service Warns of Chip Card Scheme
The U.S. Secret Service is warning financial institutions about a new scam involving the temporary theft of chip-based debit cards issued to large corporations. In this scheme, the fraudsters intercept new debit cards in the mail and replace the chips on the cards with chips from old cards. When the unsuspecting…
256
Faxploit: Sending Fax Back to the Dark Ages
Research By: Eyal Itkin, Yannay Livneh and Yaniv Balmas Fax, the brilliant technology that lifted mankind out the dark ages of mail delivery when only the postal service and carrier pigeons were used to deliver a physical message from a sender to a receiver. Technology wise, however, that was a long time ago. Today […]
257
A Beginner's Guide to Firewalling with pf
This guide is written for the person very new to firewalling. Please realize that the sample firewall we build should not be considered appropriate for actual use. I just try to cover a few basics, that took me awhile to grasp from the better known (and more detailed) documentation referenced below
258
Voice Phishing Scams Are Getting More Clever
Most of us have been trained to be wary of clicking on links and attachments that arrive in emails unexpected, but it’s easy to forget scam artists are constantly dreaming up innovations that put a new shine on old-fashioned telephone-based phishing scams. Think you’re too smart to fall for one? Think again: Even…
259
Some thoughts on Spectre and Meltdown
The story of these attacks starts in late 2004. I had submitted my doctoral thesis and had a few months before flying back to Oxford for my defense, so I turned to some light reading: Intel's latest "Optimization Manual", full of tips on how to write faster code. (Eking out every last nanosecond of performance has…
260
Potent malware that hid for six years spread through routers
While analyzing some memory dumps suspicious of being infected with a keylogger, we identified a library containing strings to interact with a virtual file system. This turned out to be a malicious loader internally named “Slingshot”.
261
No, PGP is not broken, not even with the Efail vulnerabilities
Recently, news broke about potential vulnerabilities in PGP, dubbed Efail. However, despite reports to the contrary, PGP is not actually broken, as we will explain in this post.
262
A researcher’s tale of defeating traps, tricks, and complex virtual machines
Office 365 Advanced Threat Protection (Office 365 ATP) blocked many notable zero-day exploits in 2017. In our analysis, one activity group stood out: NEODYMIUM. This threat actor is remarkable for two reasons: FinFisher is such a complex piece of malware that, like other researchers, we had to devise special methods…
263
Joanna Rutkowska leaves Qubes OS, joins Golem
Earlier this year, I decided to take a sabbatical. I wanted to reflect on my infosec work and decide what I would like to focus on in the coming years. As you probably know, I’ve spent the last nine years mostly fighting the battle to secure the endpoint, more specifically creating, dev...
264
2,800 New Data Breaches with 80M Records Added
tl;dr - a collection of nearly 3k alleged data breaches has appeared with a bunch of data already proven legitimate from previous incidents, but also tens of millions of addresses that haven't been seen in HIBP before. Those 80M records are now searchable, read on for the full story:
265
How to dismantle a compiler bomb
You have heard of “zip bombs” (a tiny ZIP file that decompresses to multiple gigabytes) and “XML bombs” (small XML file abusing the entities to consume lots of memory), and …
266
The False Allure of Hashing for Anonymization
Why using cryptographic hashes doesn't make data anonymous.
267
How the modern containerization trend is exploited by attackers
This MacKeeper report will tell you about 6 major data breaches that happened in 2018.
268
269
OpenPGPjs v3.0
We're happy to announce a major new version of OpenPGPjs, the world's most widely used JavaScript PGP encryption library. Version 3.0 brings many enhancements to the hundreds of applications and millions of users who rely on OpenPGPjs.
270
