61
Privacy Is Just the First Step, the Goal Is Data Ownership
Privacy for privacy sake is a weak argument, and privacy advocates should abandon it.
62
How Facebook Avoids Ad Blockers
How Facebook hides the word 'Sponsored' from ad blockers using per-character spans and DOM obfuscation, pulled apart piece by piece.
63
San Diego Implemented City-Wide Streetlight Surveillance
Civil Rights, Criminal Justice and Homeland Security
64
Should you be concerned about LastPass uploading your passwords to its server?
The answer to this question is still "Yes!" Here I demonstrate yet another way for the server to access your data, the issues being structural.
65
66
Android App Reverse Engineering 101
Learn to reverse engineer Android applications!
67
68
69
Interview with the Guy Who Tried to Frame Me for Heroin Possession
In April 2013, I received via U.S. mail more than a gram of pure heroin as part of a scheme to get me arrested for drug possession. But the plan failed and the Ukrainian mastermind behind it soon after was imprisoned for unrelated cybercrime offenses. That individual recently gave his first interview since finishing…
70
71
Elsevier threatens others for linking to Sci-Hub but does so itself
Sci-Hub is a copyright-violating site that provides infringing access to scholarly publications that are behind paywalls. Its ethics are problematic but it’s...
72
Mass cellphone surveillance experiment in Spain
Spanish Statistics Institute will track all cellphones for eight days (2 min, link in Spanish, via) A few facts first: Carriers geotrack all users by default, using cell tower triangulation. They also store logs of your calls and sms, but that is
73
Facebook Plans on Backdooring WhatsApp?
This article points out that Facebook’s planned content moderation scheme will result in an encryption backdoor into WhatsApp: In Facebook’s vision, the actual end-to-end encryption client itself such as WhatsApp will include embedded content moderation and blacklist filtering algorithms. These algorithms will be…
74
75
The Day I Fell in Love with Fuzzing
In 2007 I wrote a pair of modding tools, binitools , for a space trading and combat simulation game named Freelancer . The game stores its non-art assets in the format of “binary INI” files, or “BINI” files. The motivation for the binary format over traditional INI files was probably performance: it’s faster to load…
76
How does Apple privately find offline devices?
At Monday’s WWDC conference, Apple announced a cool new feature called “Find My”. Unlike Apple’s “Find my iPhone”, which uses cellular communication and the lost…
77
Getting Started with Security Keys
How to stay safe online and prevent phishing with FIDO2, WebAuthn and security keys. A look into YubiKeys, TOTP authenticator apps, passwordless and more.
78
What I Learned Trying to Secure Congressional Campaigns
You know how it happens. You try to secure one Congressional campaign, and then another, and pretty soon you can't stop. You'll fly across the country just to brief a Green Party candidate in a district the Republicans carried by 60 points. You want more, more, always looking for that next fix.
79
‘Evil Corp,’ a $100M Cybercrime Menace
The U.S. Justice Department this month offered a $5 million bounty for information leading to the arrest and conviction of a Russian man indicted for allegedly orchestrating a vast, international cybercrime network that called itself “ Evil Corp ” and stole roughly $100 million from businesses and consumers. As it…
80
Let’s Encrypt to transition to ISRG root
Let's Encrypt have announced that on July 8th, 2019 they will begin issuing new certificates from their own intermediate CA and not their current cross-signed intermediate. Here's what that means and what action, if any, site operators need to take…
81
Reverse engineering a custom CPU from a single program
or: reverse-engineering a custom, unknown CPU from a single programtl;dr: We reverse-engineered a program written for a completely custom, unknown CPU architecture, without any documentation for th…
82
Weaponizing and Gamifying AI for WiFi Hacking: Presenting Pwnagotchi 1.0.0
This is the story of a summer project that started out of boredom and that evolved into something incredibly fun and unique. It is also the story of how that p…
83
An Overview of Cryptography
Free, evolving crypto tutorial since 1999!
84
Attorney General Barr and Encryption
Last month, Attorney General William Barr gave a major speech on encryption policy—what is commonly known as “going dark.” Speaking at Fordham University in New York, he admitted that adding backdoors decreases security but that it is worth it. Some hold this view dogmatically, claiming that it is technologically…
85
Infectious Executable Stacks
In software development there are many concepts that at first glance seem useful and sound, but, after considering the consequences of their implementation and use, are actually horrifying. Examples include thread cancellation , variable length arrays , and memory aliasing . GCC’s closure extension to C is another…
86
Modern C++ Won't Save Us
I’m a frequent critic of memory unsafe languages, principally C and C++, and how they induce an exceptional number of security vulnerabilities. My conclusion, based on reviewing evidence from numerous large software projects using C and C++, is that we need to be migrating our industry to memory safe by default…
87
I scanned Austria
Personal Blog of Christian Haschek
88
The 773M Record “Collection #1” Data Breach
Many people will land on this page after learning that their email address has appeared in a data breach I've called "Collection #1". Most of them won't have a tech background or be familiar with the concept of credential stuffing so I'm going to write this post
89
WordPress theme provider Pipdig using customer sites to DDoS competitors
pipdig, WordPress theme and plugin provider, caught distributing malicious code to customers and DDoSing competitors…
90
