91
A Visual Guide to SSH Tunnels: Local and Remote Port Forwarding
SSH port forwarding explained in a clean and visual way. How to use local and remote port forwarding. What sshd settings may need to be adjusted. How to memorize the right flags.
92
Hackers stole access tokens from Okta's support unit
Okta , a company that provides identity tools like multi-factor authentication and single sign-on to thousands of businesses, has suffered a security breach involving a compromise of its customer support unit, KrebsOnSecurity has learned. Okta says the incident affected a “very small number” of customers, however it…
93
From email to phone number, a new OSINT approach (2019)
How to find out someone's phone number if you just know their email address and how it can be automated using a new OSINT tool: email2phonenumber
94
Blocking Visual Studio Code embedded reverse shell before it's too late
Visual studio code tunnel Introduction Since July 2023, Microsoft is offering the perfect reverse shell, embedded inside Visual Studio Code, a widely used …
95
Grave flaws in BGP Error handling
Border Gateway Protocol is the de facto protocol that directs routing decisions between different ISP networks, and is generally known as the “glue” that holds the internet together. It’s safe to say that the internet we currently know would not function without working BGP implementations.
96
Become Ungoogleable
I've removed my website from indexing by Google . The proximate cause is Google's new effort to DRM the web ( archive ) but there is of course so much more.
97
98
Desktop Linux Hardening (2022)
Linux is not a secure desktop operating system. However, there are steps you can take to harden it, reduce its attack surface, and improve its privacy. Before we start… Some of the sections will include mentions of unofficial builds of packages like linux‑hardened, akmod, hardened_malloc, and so on. These are not…
99
Running the "Reflections on Trusting Trust" Compiler
Supply chain security is a hot topic today, but it is a very old problem. In October 1983, 40 years ago this week, Ken Thompson chose supply chain security as the topic for his Turing award lecture, although the specific term wasn’t used back then. (The field of computer science was still young and small enough that…
100
Why we don’t generate elliptic curves every day
Elliptic curves are standardized, instead of being generated like Diffie-Hellman parameters. There's good reasons!
101
Fake chips, I got stung
Unfortunately, in the tech sector, just like many other sectors, there are scammers around. When you are dealing with electronics this is typically in the form of chips that have had their markings…
102
The presumption that computers are working correctly
The first in a series of posts on the Post Office Horizon prosecutions scandal
103
Hyundai Head Unit Hacking
Standard-class Gen5 navigation
104
Deleting System32\curl.exe
Let me tell you a story about how Windows users are deleting files from their installation and as a consequence end up in tears. Background The real and actual curl tool has been shipped as part of Windows 10 and Windows 11 for many years already. It is called curl.exe and is located in the … Continue reading deleting…
105
"<ESC>[31M"? ANSI Terminal security in 2023 and finding 10 CVEs
This paper reflects work done in late 2022 and 2023 to audit for vulnerabilities in terminal emulators, with a focus on open source software. The results of this work were 10 CVEs against terminal emulators that could result in Remote Code Execution (RCE), in addition various other bugs and hardening opportunities…
106
107
The Dutch government wants automatic permission to target victims of hackers
This is a mirror of the original about:intel post, since the about:intel server is sadly sometimes overloaded. Also do read the opposing view from Jan-Jaap Oerlemans and the reflection by Lotte Houwing The Dutch government is proposing adding a lex specialis to its existing intelligence and security services act. This…
108
109
Did I receive fraudulent DMCA takedowns?
I received 3 DMCA takedown emails today, covering 7350 URLs on my hardbin.com IPFS gateway. The URLs were allegedly serving infringing copies of books. The strange part is that of those 7350 URLs, during the time for which I have nginx logs, none of them have ever been accessed , and of the ones that I checked, none…
110
On the 10th anniversary of the Snowden revelations
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
111
Why even let users set their own passwords?
Today we seem to be living through a war on passwords. This is manifested in various ways; in its most passive form, it takes the form of people blogging about how passwords are bad. The more material changes are the general trend towards no longer treating passwords as a sufficient condition for access in favour of…
112
South Korea’s online security dead end
Websites in South Korea often require installation of “security applications.” Not only do these mandatory applications not help security, way too often they introduce issues.
113
I'm shadow banned by DuckDuckGo and Bing
My personal site has zero pages indexed by DuckDuckGo and Bing and even searches for my URL return zero results. This post is a description of the problem and the start of my journey to fix it.
114
Down the Cloudflare / Stripe / OWASP Rabbit Hole
I found myself going down a previously unexplored rabbit hole recently, or more specifically, what I thought was "a" rabbit hole but in actual fact was an ever-expanding series of them that led me to what I refer to in the title of this post as "6 rabbits deep"
115
Web hackers vs. the auto industry
While we were visiting the University of Maryland, we came across a fleet of electric scooters scattered across the campus and couldn't resist poking at the scooter's mobile app. To our surprise, our actions caused the horns and headlights on all of the scooters to turn on and stay on for 15 minutes straight.
116
Self-driving cars are surveillance cameras on wheels
Police are already using self-driving car footage as video evidence: While security cameras are commonplace in American cities, self-driving cars represent a new level of access for law enforcement and a new method for encroachment on privacy, advocates say. Crisscrossing the city on their routes, self-driving cars…
117
EU "Chat Control" and Mandatory Client Side Scanning
On the 11th of October, Dutch parliament organized a hearing on the EU “Chatcontrol” proposal, with a focus on client side scanning. Dutch parliament had earlier passed two motions calling on the Dutch government not to support this proposal, but our government has declared it will ignore those motions. This hearing…
118
Some new snippets from the Snowden documents
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
119
Breaking RSA with a quantum computer?
A group of Chinese researchers have just published a paper claiming that they can—although they have not yet done so—break 2048-bit RSA. This is something to take seriously. It might not be correct, but it’s not obviously wrong. We have long known from Shor’s algorithm that factoring with a quantum computer is easy…
120
Finland’s most-wanted hacker nabbed in France
Julius “Zeekill” Kivimäki, a 25-year-old Finnish man charged with extorting a local online psychotherapy practice and leaking therapy notes for more than 22,000 patients online, was arrested this week in France. A notorious hacker convicted of perpetrating tens of thousands of cybercrimes, Kivimäki had been in hiding…