jm + security   372

Alarm systems alarmingly insecure. Oh the irony | Pen Test Partners
Some absolutely abysmal security practices used in off-the-shelf self-installed wireless home alarm systems -- specifically the Yale HSA6400. Simple replay attacks of the unlock PIN message, for instance
security  home  wireless  alarms  yale  fail 
17 hours ago by jm
Falling through the KRACKs
I want to talk about why this vulnerability continues to exist so many years after WPA was standardized. And separately, to answer a question: how did this attack slip through, despite the fact that the 802.11i handshake was formally proven secure?
krack  security  wpa  wifi  ieee  crypto  vulnerabilities 
2 days ago by jm
Over The Air - Vol. 2, Pt. 3: Exploiting The Wi-Fi Stack on Apple Devices
This is the most amazing hack.

Upon successful execution, the exploit exposes APIs to read and write the host’s physical memory directly over-the-air, by mapping in any requested address to the controlled DART L2 translation table, and issuing DMA accesses to the corresponding mapped IO-Space addresses.
hacks  exploits  security  ios  wifi  apple  iphone  kernel 
3 days ago by jm
The world's first cyber-attack, on the Chappe telegraph system, in Bordeaux in 1834

The Blanc brothers traded government bonds at the exchange in the city of Bordeaux, where information about market movements took several days to arrive from Paris by mail coach. Accordingly, traders who could get the information more quickly could make money by anticipating these movements. Some tried using messengers and carrier pigeons, but the Blanc brothers found a way to use the telegraph line instead. They bribed the telegraph operator in the city of Tours to introduce deliberate errors into routine government messages being sent over the network.
The telegraph’s encoding system included a “backspace” symbol that instructed the transcriber to ignore the previous character. The addition of a spurious character indicating the direction of the previous day’s market movement, followed by a backspace, meant the text of the message being sent was unaffected when it was written out for delivery at the end of the line. But this extra character could be seen by another accomplice: a former telegraph operator who observed the telegraph tower outside Bordeaux with a telescope, and then passed on the news to the Blancs. The scam was only uncovered in 1836, when the crooked operator in Tours fell ill and revealed all to a friend, who he hoped would take his place. The Blanc brothers were put on trial, though they could not be convicted because there was no law against misuse of data networks. But the Blancs’ pioneering misuse of the French network qualifies as the world’s first cyber-attack.
bordeaux  hacking  history  security  technology  cyber-attacks  telegraph  telegraphes-chappe 
13 days ago by jm
Cashing in on ATM Malware - A Comprehensive Look at Various Attack Types
rather unnerving report from Trend Micro / Europol.

'As things stand, it looks like different criminal groups have already graduated from physical to virtual
skimming via malware, thanks to the lack of security measures implemented by commercial banks
worldwide. This is common in Latin America and Eastern Europe, but these criminals are exporting the
technique and have started to victimize other countries.'
atms  banking  security  trend-micro  banks  europol  exploits 
17 days ago by jm
The Israeli Digital Rights Movement's campaign for privacy | Internet Policy Review
This study explores the persuasion techniques used by the Israeli Digital Rights Movement in its campaign against Israel’s biometric database. The research was based on analysing the movement's official publications and announcements and the journalistic discourse that surrounded their campaign within the political, judicial, and public arenas in 2009-2017. The results demonstrate how the organisation navigated three persuasion frames to achieve its goals: the unnecessity of a biometric database in democracy; the database’s ineffectiveness; and governmental incompetence in securing it. I conclude by discussing how analysing civil society privacy campaigns can shed light over different regimes of privacy governance. [....]

1. Why the database should be abolished: because it's not necessary - As the organisation highlighted repeatedly throughout the campaign with the backing of cyber experts, there is a significant difference between issuing smart documents and creating a database. Issuing smart documents effectively solves the problem of stealing and forging official documents, but does it necessarily entail the creation of a database? The activists’ answer is no: they declared that while they do support the transition to smart documents (passports and ID cards) for Israeli citizens, they object to the creation of a database due to its violation of citizens' privacy.

2. Why the database should be abolished: because it's ineffective; [...]

3. Why the database should be abolished: because it will be breached - The final argument was that the database should be abolished because the government would not be able to guarantee protection against security breaches, and hence possible identity theft.
digital-rights  privacy  databases  id-cards  israel  psc  drm  identity-theft  security 
20 days ago by jm
Gas Pump Skimmers - learn.sparkfun.com
For those who don’t want to read through the gritty details here’s the summary:

These skimmers are cheap and are becoming more common and more of a nuisance across north america.

The skimmer broadcasts over bluetooth as HC-05 with a password of 1234. If you happen to be at a gas pump and happen to scan for bluetooth devices and happen to see an HC-05 listed as an available connection then you probably don’t want to use that pump.

The bluetooth module used on these skimmers is extremely common and used on all sorts of legitimate products end educational kits. If you detect one in the field you can confirm that it is a skimmer (and not some other device) by sending the character ‘P’ to the module over a terminal. If you get a ’M' in response then you have likely found a skimmer and you should contact your local authorities.
crime  hardware  bluetooth  security  electronics  skimmers  gas-stations  usa  petrol-stations  hc-05 
28 days ago by jm
Turning Off Wi-Fi and Bluetooth in iOS 11's Control Center Doesn’t Actually Turn Off Wi-Fi or Bluetooth - Motherboard
"in iOS 11 and later, when you toggle the Wi-Fi or Bluetooth buttons in Control Center, your device will immediately disconnect from Wi-Fi and Bluetooth accessories. Both Wi-Fi and Bluetooth will continue to be available." That is because Apple wants the iPhone to be able to continue using AirDrop, AirPlay, Apple Pencil, Apple Watch, Location Services, and other features, according to the documentation.
wifi  bluetooth  iphone  ios  security  fail  off-means-off 
28 days ago by jm
malware piggybacking on CCleaner
On September 13, 2017 while conducting customer beta testing of our new exploit detection technology, Cisco Talos identified a specific executable which was triggering our advanced malware protection systems. Upon closer inspection, the executable in question was the installer for CCleaner v5.33, which was being delivered to endpoints by the legitimate CCleaner download servers. Talos began initial analysis to determine what was causing this technology to flag CCleaner. We identified that even though the downloaded installation executable was signed using a valid digital signature issued to Piriform, CCleaner was not the only application that came with the download. During the installation of CCleaner 5.33, the 32-bit CCleaner binary that was included also contained a malicious payload that featured a Domain Generation Algorithm (DGA) as well as hardcoded Command and Control (C2) functionality. We confirmed that this malicious version of CCleaner was being hosted directly on CCleaner's download server as recently as September 11, 2017.
ccleaner  malware  avast  piriform  windows  security 
4 weeks ago by jm
Malicious typosquatting packages in PyPI
skcsirt-sa-20170909-pypi vulnerability announcement from SK-CSIRT:
SK-CSIRT identified malicious software libraries in the official Python package
repository, PyPI, posing as well known libraries. A prominent example is a fake
package urllib-1.21.1.tar.gz, based upon a well known package
urllib3-1.21.1.tar.gz.

Such packages may have been downloaded by unwitting developer or administrator
by various means, including the popular “pip” utility (pip install urllib).
There is evidence that the fake packages have indeed been downloaded and
incorporated into software multiple times between June 2017 and September 2017.
pypi  python  typos  urllib  security  malware 
4 weeks ago by jm
GitHub - hillbrad/U2FReviews
'Reviews of U2F [Universal Second Factor] devices' -- ie. Yubico keys et al.
u2f  totp  oath  otp  one-time-passwords  authentication  devices  gadgets  security  2fa 
8 weeks ago by jm
Malicious packages in npm
The node.js packaging system is being exploited by bad guys to steal auth tokens at build time. This is the best advice they can come up with:
Always check the name of packages you’re installing. You can look at the downloads number: if a package is popular but the downloads number is low, something is wrong.


:facepalm: What a mess. Security needs to become a priority....
javascript  security  npm  node  packaging  packages  fail 
11 weeks ago by jm
How the coffee-machine took down a factories control room : talesfromtechsupport
A coffee machine was plugged into both a secure network and also connected to the main wifi network, and became a vector for malware to take down the factory's control room. Security is hard
coffee-machines  fail  security  networking  wifi 
12 weeks ago by jm
SECURITY ALERT - Critical bug in Parity's MultiSig-Wallet
'Together, we were able to determine that malicious actors had exploited a flaw in the Parity Multisig code, which allowed a known party to steal over 153,000 ETH from several projects including Edgeless Casino, Aeternity, and Swarm City.'

by leaving "internal" (a visibility restricting keyword) off of the wallet contract, it was possible for attackers to steal millions from a "secure" multi-sig wallet in Ethereum: https://press.swarm.city/parity-multisig-wallet-exploit-hits-swarm-city-funds-statement-by-the-swarm-city-core-team-d1f3929b4e4e

https://twitter.com/ncweaver/status/887821804038873088 : 'Time from "OMFG there is a bug" to "geez, someone steal $16M"? 2 hours. Gotta love JavaScript FunBukx, err Ethereum'
ethereum  fail  security  exploits  javascript  parity 
july 2017 by jm
Chris's Wiki :: blog/sysadmin/UnderstandingIODNSIssue
On the ns-a1.io security screwup for the .io CCTLD:
Using data from glue records instead of looking things up yourself is common but not mandatory, and there are various reasons why a resolver would not do so. Some recursive DNS servers will deliberately try to check glue record information as a security measure; for example, Unbound has the harden-referral-path option (via Tony Finch). Since the original article reported seeing real .io DNS queries being directed to Bryant's DNS server, we know that a decent number of clients were not using the root zone glue records. Probably a lot more clients were still using the glue records, through.


(via Tony Finch)
via:fanf  dns  security  dot-io  cctlds  glue-records  delegation 
july 2017 by jm
mozilla/sops: Secrets management stinks, use some sops!
sops is an editor of encrypted files that supports YAML, JSON and BINARY formats and encrypts with AWS KMS and PGP.
secrets  encryption  security  kms  pgp  gpg  editors  configuration 
july 2017 by jm
Use AWS WAF to Mitigate OWASP’s Top 10 Web Application Vulnerabilities
'describes how you can use AWS WAF, a web application firewall, to address the top application security flaws as named by the Open Web Application Security Project (OWASP). Using AWS WAF, you can write rules to match patterns of exploitation attempts in HTTP requests and block requests from reaching your web servers. This whitepaper discusses manifestations of these security vulnerabilities, AWS WAF–based mitigation strategies, and other AWS services or solutions that can help address these threats.'
security  waf  aws  http  owasp  filtering 
july 2017 by jm
Talos Intelligence review of Nyetya and the M.E.Doc compromise
Our Threat Intelligence and Interdiction team is concerned that the actor in question burned a significant capability in this attack.  They have now compromised both their backdoor in the M.E.Doc software and their ability to manipulate the server configuration in the update server. In short, the actor has given up the ability to deliver arbitrary code to the 80% of UA businesses that use M.E.Doc as their accounting software, along with any multinational corporations that leveraged the software.  This is a significant loss in operational capability, and the Threat Intelligence and Interdiction team assesses with moderate confidence that it is unlikely that they would have expended this capability without confidence that they now have or can easily obtain similar capability in target networks of highest priority to the threat actor.
security  malware  nyetya  notpetya  medoc  talos  ransomware 
july 2017 by jm
Revealed: Facebook exposed identities of moderators to suspected terrorists | Technology | The Guardian
Oh man, this is awful. Poor guy. And this should have been there right from the start:
The moderator said that when he started, he was given just two weeks training and was required to use his personal Facebook account to log into the social media giant’s moderation system.

“They should have let us use fake profiles,” he said, adding: “They never warned us that something like this could happen.”

Facebook told the Guardian that as a result of the leak it is testing the use of administrative accounts that are not linked to personal profiles.
facebook  security  counter-terrorism  moderation  social-media  role-accounts  admin 
june 2017 by jm
Mounir Mahjoub​i​, the 'geek' who saved Macron's campaign: 'We knew we were going to be attacked' | World news | The Guardian
What a great story.

As a child, he was into maths and geometry, the middle child with one sister 10 years older and another 10 years younger. “I heard about this incredible new thing called the internet,” he says, adding how, aged 12, he saw an advert for the Paris science museum where you could try the internet for free. “There were 15 computers and you queued to have an hour free if you bought an entry ticket. I bought an annual pass to the museum and every Saturday and Sunday I’d travel from one side of Paris to the other to get on the internet and see what it was about. I’d go on Yahoo, chat with people on the other side of the world. I didn’t speak great English then so it wasn’t brilliant chat ...”


(via Niall Murphy)
france  mounir-mahjoubi  internet  computers  society  macron  politics  security 
june 2017 by jm
How Turla hackers (ab)used satellites to stay under the radar | Ars Technica
A very nifty hack. DVB-S broadcasts a subset of unencrypted IP traffic across a 600-mile radius:
The Turla attackers listen for packets coming from a specific IP address in one of these classes. When certain packets—say, a TCP/IP SYN packet—are identified, the hackers spoof a reply to the source using a conventional Internet line. The legitimate user of the link just ignores the spoofed packet, since it goes to an otherwise unopened port, such as port 80 or 10080. With normal Internet connections, if a packet hits a closed port, the end user will normally send the ISP some indication that something went wrong. But satellite links typically use firewalls that drop packets to closed ports. This allows Turla to stealthily hijack the connections.

The hack allowed computers infected with Turla spyware to communicate with Turla C&C servers without disclosing their location. Because the Turla attackers had their own satellite dish receiving the piggybacked signal, they could be anywhere within a 600-mile radius. As a result, researchers were largely stopped from shutting down the operation or gaining clues about who was carrying it out.

"It's probably one of the most effective methods of ensuring their operational security, or that nobody will ever find out the physical location of their command and control server," Tanase told Ars. "I cannot think of a way of identifying the location of a command server. It can be anywhere in the range of the satellite beam."
turla  hacks  satellite  security  dvb  dvb-s  tcpip  command-and-control  syn 
june 2017 by jm
Turla’s watering hole campaign: An updated Firefox extension abusing Instagram
Pretty crazy.
The extension will look at each photo’s comment and will compute a custom hash value. If the hash matches 183, it will then run this regular expression on the comment in order to obtain the path of the bit.ly URL:
(?:\\u200d(?:#|@)(\\w)

Looking at the photo’s comments, there was only one for which the hash matches 183. This comment was posted on February 6, while the original photo was posted in early January. Taking the comment and running it through the regex, you get the following bit.ly URL: bit.ly/2kdhuHX

Looking a bit more closely at the regular expression, we see it is looking for either @|# or the Unicode character \200d. This character is actually a non-printable character called ‘Zero Width Joiner’, normally used to separate emojis. Pasting the actual comment or looking at its source, you can see that this character precedes each character that makes the path of the bit.ly URL
security  malware  russia  turla  zwj  unicode  characters  social-media  instagram  command-and-control 
june 2017 by jm
'I've Got Nothing to Hide' and Other Misunderstandings of Privacy by Daniel J. Solove :: SSRN
In this short essay, written for a symposium in the San Diego Law Review, Professor Daniel Solove examines the nothing to hide argument. When asked about government surveillance and data mining, many people respond by declaring: "I've got nothing to hide." According to the nothing to hide argument, there is no threat to privacy unless the government uncovers unlawful activity, in which case a person has no legitimate justification to claim that it remain private. The nothing to hide argument and its variants are quite prevalent, and thus are worth addressing. In this essay, Solove critiques the nothing to hide argument and exposes its faulty underpinnings.


Via Fred Logue
law  philosophy  privacy  security  essay  papers  daniel-solove  surveillance  snooping 
may 2017 by jm
V2V and the challenge of cooperating technology
A great deal of effort and attention has gone into a mobile data technology that you may not be aware of. This is "Vehicle to Vehicle" (V2V) communication designed so that cars can send data to other cars. There is special spectrum allocated at 5.9ghz, and a protocol named DSRC, derived from wifi, exists for communications from car-to-car and also between cars and roadside transmitters in the infrastructure, known as V2I.

This effort has been going on for some time, but those involved have had trouble finding a compelling application which users would pay for. Unable to find one, advocates hope that various national governments will mandate V2V radios in cars in the coming years for safety reasons. In December 2016, the U.S. Dept. of Transportation proposed just such a mandate. [....] "Connected Autonomous Vehicles -- Pick 2."
cars  self-driving  autonomous-vehicles  v2v  wireless  connectivity  networking  security 
may 2017 by jm
The World Is Getting Hacked. Why Don’t We Do More to Stop It? - The New York Times
Zeynep Tufekci is (as usual!) on the money with this op-ed. I strongly agree with the following:
First, companies like Microsoft should discard the idea that they can abandon people using older software. The money they made from these customers hasn’t expired; neither has their responsibility to fix defects. Besides, Microsoft is sitting on a cash hoard estimated at more than $100 billion (the result of how little tax modern corporations pay and how profitable it is to sell a dominant operating system under monopolistic dynamics with no liability for defects).

At a minimum, Microsoft clearly should have provided the critical update in March to all its users, not just those paying extra. Indeed, “pay extra money to us or we will withhold critical security updates” can be seen as its own form of ransomware. In its defense, Microsoft probably could point out that its operating systems have come a long way in security since Windows XP, and it has spent a lot of money updating old software, even above industry norms. However, industry norms are lousy to horrible, and it is reasonable to expect a company with a dominant market position, that made so much money selling software that runs critical infrastructure, to do more.

Microsoft should spend more of that $100 billion to help institutions and users upgrade to newer software, especially those who run essential services on it. This has to be through a system that incentivizes institutions and people to upgrade to more secure systems and does not force choosing between privacy and security. Security updates should only update security, and everything else should be optional and unbundled.

More on this twitter thread: https://twitter.com/zeynep/status/863734133188681732
security  microsoft  upgrades  windows  windows-xp  zeynep-tufekci  worms  viruses  malware  updates  software 
may 2017 by jm
iKydz
'Total Parent Control' for kids internet access at home. Dublin-based product, dedicated wifi AP with lots of child-oriented filtering capabilities
filtering  security  ikydz  kids  children  internet  wifi  ap  hardware  blocking 
may 2017 by jm
Backdooring an AWS account
eek. Things to look out for on your AWS setup:
So you’ve pwned an AWS account — congratulations — now what? You’re eager to get to the data theft, amirite? Not so fast whipper snapper, have you disrupted logging? Do you know what you have? Sweet! Time to get settled in. Maintaining persistence in AWS is only limited by your imagination but there are few obvious and oft used techniques everyone should know and watch for.
aws  security  hacks  iam  sts 
may 2017 by jm
Online security won’t improve until companies stop passing the buck to the customer
100% agreed!
Giving good security advice is hard because very often individuals have little or no effective control over their security. The extent to which a customer is at risk of being defrauded largely depends on how good their bank’s security is, something customers cannot know.

Similarly, identity fraud is the result of companies doing a poor job at verifying identity. If a criminal can fraudulently take out a loan using another’s name, address, and date of birth from the public record, that’s the fault of the lender – not, as Cifas, a trade organisation for lenders, claims, because customers “don’t take the same care to protect our most important asset – our identities”.
cifas  uk  passwords  security  regulation  banking  ncsc  riscs  advice 
may 2017 by jm
After years of warnings, mobile network hackers exploit SS7 flaws to drain bank accounts • The Register
Experts have been warning for years about security blunders in the Signaling System 7 protocol – the magic glue used by cellphone networks to communicate with each other. [...]

O2-Telefonica in Germany has confirmed to Süddeutsche Zeitung that some of its customers have had their bank accounts drained using a two-stage attack that exploits SS7.

In other words, thieves exploited SS7 to intercept two-factor authentication codes sent to online banking customers, allowing them to empty their accounts. The thefts occurred over the past few months, according to multiple sources.
o2  telefonica  germany  ss7  mobile  2fa  security  hacks  cellphones 
may 2017 by jm
Capturing all the flags in BSidesSF CTF by pwning Kubernetes/Google Cloud
good exploration of the issues with running a CTF challenge (or any other secure infrastructure!) atop Kubernetes and a cloud platform like GCE
gce  google-cloud  kubernetes  security  docker  containers  gke  ctf  hacking  exploits 
april 2017 by jm
NVD - CVE-2016-10229
udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with the MSG_PEEK flag.
udp  security  cve  linux  msg_peek  exploits 
april 2017 by jm
Smart TV hack embeds attack code into broadcast signal—no access required | Ars Technica
Awesome.
The proof-of-concept exploit uses a low-cost transmitter to embed malicious commands into a rogue [DVB-T] signal. That signal is then broadcast to nearby devices. It worked against two fully updated TV models made by Samsung. By exploiting two known security flaws in the Web browsers running in the background, the attack was able to gain highly privileged root access to the TVs. By revising the attack to target similar browser bugs found in other sets, the technique would likely work on a much wider range of TVs.
dvb-t  tv  security  exploits  samsung  smart-tvs  broadcast 
april 2017 by jm
Watching the hearings, I learned my "Bernie bro" harassers may have been Russian bots
However, the rest of the abuse came from accounts purporting to be supporters of Vermont Independent Senator Bernie Sanders. And these were “people” with whom I believed I shared common values and policy interests. Almost all of the accounts presented as men — mostly young and white — and used sexist and misogynistic tones and words. I was called “mom” and “grandma” as epithets by these “young men.” I was called every vile sexualized name you can imagine. For some reason that I did not understand at the time, they liked to call me a “vagina.” (I now believe non-native English — i.e. Russian — speakers wrote the algorithms controlling these bots and perhaps imagined “vagina” to be the equivalent of the c-word when hurled at a woman.) Not being conversant in the mechanisms of Russian psychological warfare techniques at the time, it never occurred to me that, like the #MAGA bots, these “Bernie Bro” accounts were actually bots too.
And the abuse from these accounts was much harder to dismiss. It went in further, emotionally speaking. The vitriol of the attacks felt like a painful betrayal. After all, “we” probably shared 99 percent of our political perspective; we just supported different candidates — which is something I said repeatedly in my attempts to appeal to reason with some of the attackers over the course of those long months. Nonetheless, even the mildest criticism of Sanders or comment of support for Clinton would bring out a swarm of these “Bernie Bro” accounts spouting off with abusive language and mockery.
bernie-bros  abuse  twitter  russia  security  bots  elections  hilary-clinton 
april 2017 by jm
American Snoper – Medium
The grugq on Putin vs France:
How modern conflicts play out in the informatics sphere, what I mean when I talk about cyber war, is happening in France. After France there will be Germany, then the Scandinavian countries have their elections. There is no chance that Putin attempting to shape the world to best suit Russian interests will abate. Currently, the strongest area that he can contend in is the informatics sphere, the cyber realm, where human perception of reality is shaped.
putin  france  elections  russia  cyber-war  hacking  security  wikileaks 
march 2017 by jm
[no title]
'For decades, the transaction concept has played a central role in
database research and development. Despite this prominence, transactional
databases today often surface much weaker models than the
classic serializable isolation guarantee—and, by default, far weaker
models than alternative,“strong but not serializable” models such as
Snapshot Isolation. Moreover, the transaction concept requires the
programmer’s involvement: should an application programmer fail
to correctly use transactions by appropriately encapsulating functionality,
even serializable transactions will expose programmers
to errors. While many errors arising from these practices may be
masked by low concurrency during normal operation, they are susceptible
to occur during periods of abnormally high concurrency. By
triggering these errors via concurrent access in a deliberate attack, a
determined adversary could systematically exploit them for gain.
In this work, we defined the problem of ACIDRain attacks and
introduced 2AD, a lightweight dynamic analysis tool that uses traces
of normal database activity to detect possible anomalous behavior
in applications. To enable 2AD, we extended Adya’s theory of weak
isolation to allow efficient reasoning over the space of all possible
concurrent executions of a set of transactions based on a concrete
history, via a new concept called an abstract history, which also
applies to API calls. We then applied 2AD analysis to twelve popular
self-hosted eCommerce applications, finding 22 vulnerabilities
spread across all but one application we tested, affecting over 50%
of eCommerce sites on the Internet today.

We believe that the magnitude and the prevalence of these vulnerabilities
to ACIDRain attacks merits a broader reconsideration of
the success of the transaction concept as employed by programmers
today, in addition to further pursuit of research in this direction.
Based on our early experiences both performing ACIDRain attacks
on self-hosted applications as well as engaging with developers, we
believe there is considerable work to be done in raising awareness
of these attacks—for example, via improved analyses and additional
2AD refinement rules (including analysis of source code to
better highlight sources of error)—and in automated methods for defending
against these attacks—for example, by synthesizing repairs
such as automated isolation level tuning and selective application
of SELECT FOR UPDATE mechanisms. Our results here—as well as
existing instances of ACIDRain attacks in the wild—suggest there
is considerable value at stake.'
databases  transactions  vulnerability  security  acidrain  peter-bailis  storage  isolation  acid 
march 2017 by jm
That thing about pwning N26
Whitehat CCC hacker thoroughly pwns N26 bank -- there's a lot of small leaks and insecurities here. Sounds like N26 are dealing with them though
ccc  hacks  exploits  n26  banks  banking  security 
march 2017 by jm
Gravitational Teleport
Teleport enables teams to easily adopt the best SSH practices like:

Integrated SSH credentials with your organization Google Apps identities or other OAuth identity providers.
No need to distribute keys: Teleport uses certificate-based access with automatic expiration time.
Enforcement of 2nd factor authentication.
Cluster introspection: every Teleport node becomes a part of a cluster and is visible on the Web UI.
Record and replay SSH sessions for knowledge sharing and auditing purposes.
Collaboratively troubleshoot issues through session sharing.
Connect to clusters located behind firewalls without direct Internet access via SSH bastions.
ssh  teleport  ops  bastions  security  auditing  oauth  2fa 
february 2017 by jm
St. Petersburg team operated a PRNG hack against Vegas slots
According to Willy Allison, a Las Vegas–based casino security consultant who has been tracking the Russian scam for years, the operatives use their phones to record about two dozen spins on a game they aim to cheat. They upload that footage to a technical staff in St. Petersburg, who analyze the video and calculate the machine’s pattern based on what they know about the model’s pseudorandom number generator. Finally, the St. Petersburg team transmits a list of timing markers to a custom app on the operative’s phone; those markers cause the handset to vibrate roughly 0.25 seconds before the operative should press the spin button.

“The normal reaction time for a human is about a quarter of a second, which is why they do that,” says Allison, who is also the founder of the annual World Game Protection Conference. The timed spins are not always successful, but they result in far more payouts than a machine normally awards: Individual scammers typically win more than $10,000 per day. (Allison notes that those operatives try to keep their winnings on each machine to less than $1,000, to avoid arousing suspicion.) A four-person team working multiple casinos can earn upwards of $250,000 in a single week.
prng  hacking  security  exploits  randomness  gambling  las-vegas  casinos  slot-machines 
february 2017 by jm
Banks biased against black fraud victims
We raised the issue of discrimination in 2011 with one of the banks and with the Commission for Racial Equality, but as no-one was keeping records, nothing could be proved, until today. How can this discrimination happen? Well, UK rules give banks a lot of discretion to decide whether to refund a victim, and the first responders often don’t know the full story. If your HSBC card was compromised by a skimmer on a Tesco ATM, there’s no guarantee that Tesco will have told anyone (unlike in America, where the law forces Tesco to tell you). And the fraud pattern might be something entirely new. So bank staff end up making judgement calls like “Is this customer telling the truth?” and “How much is their business worth to us?” This in turn sets the stage for biases and prejudices to kick in, however subconsciously. Add management pressure to cut costs, sometimes even bonuses for cutting them, and here we are.
discrimination  racism  fraud  uk  banking  skimming  security  fca 
january 2017 by jm
The hidden cost of QUIC and TOU
The recent movement to get all traffic encrypted has of course been great for the Internet. But the use of encryption in these protocols is different than in TLS. In TLS, the goal was to ensure the privacy and integrity of the payload. It's almost axiomatic that third parties should not be able to read or modify the web page you're loading over HTTPS. QUIC and TOU go further. They encrypt the control information, not just the payload. This provides no meaningful privacy or security benefits.

Instead the apparent goal is to break the back of middleboxes [0]. The idea is that TCP can't evolve due to middleboxes and is pretty much fully ossified. They interfere with connections in all kinds of ways, like stripping away unknown TCP options or dropping packets with unknown TCP options or with specific rare TCP flags set. The possibilities for breakage are endless, and any protocol extensions have to jump through a lot of hoops to try to minimize the damage.
quic  tou  protocols  http  tls  security  internet  crypto  privacy  firewalls  debugging  operability 
december 2016 by jm
The Perfect Weapon: How Russian Cyberpower Invaded the U.S. - The New York Times
This is scary shit. It's amazing how Russia has weaponised transparency, but I guess it's not new to observers of "kompromat": https://en.wikipedia.org/wiki/Kompromat
kompromat  russia  cyberpower  cyberwar  security  trump  us-politics  dnc 
december 2016 by jm
Did the Russians “hack” the election? A look at the established facts | Ars Technica
solid roundup. There's a whole lot of evidence pointing Russia's way, basically
usa  russia  hacking  politics  security  us-politics  trump 
december 2016 by jm
Contactless credit cards vulnerable to a range of scams
Johanson said it's possible to use an RFID "gate antenna" — two electronic readers spanning a doorway, similar to the anti-theft gates in retail stores — to scan the credit cards of people passing through. 
With enough high-powered gates installed at key doorways in a city or across the country, someone could collect comprehensive information on people's movements, buying habits and social patterns.
"These days you can buy a $500 antenna to mount in doorways that can read every card that goes through it," Johanson said.


Amazingly, these seem to be rife with holes -- they still use the legacy EMV protocol, do not require online verification with backend systems, and allow replay attacks. A Journal.ie article today claims that attackers are sniffing EMV data, then replaying it against card readers in shops in Dublin, which while it may not be true, the attack certainly seems viable...
rfid  security  scams  emv  wireless  contactless  credit-cards  replay-attacks 
december 2016 by jm
Tesco Bank: 20,000 customers lose money - BBC News
"Any financial loss that results from this fraudulent activity will be borne by the bank," Mr Higgins said. "Customers are not at financial risk."


Well, that would be surprising....
tesco  banking  fraud  security  hacks  uk 
november 2016 by jm
mjg59 | Fixing the IoT isn't going to be easy
We can't easily fix the already broken devices, we can't easily stop more broken devices from being shipped and we can't easily guarantee that we can fix future devices that end up broken. The only solution I see working at all is to require ISPs to cut people off, and that's going to involve a great deal of pain. The harsh reality is that this is almost certainly just the tip of the iceberg, and things are going to get much worse before they get any better.
iot  security  internet  isps  devices 
october 2016 by jm
Paypal 2FA Bypass
Holy shit.
Using a proxy, remove “securityQuestion0” and “securityQuestion1” from the post data.


Massive facepalm.
paypal  2fa  security  fail  web  html 
october 2016 by jm
Brian Krebs - The Democratization of Censorship
Events of the past week have convinced me that one of the fastest-growing censorship threats on the Internet today comes not from nation-states, but from super-empowered individuals who have been quietly building extremely potent cyber weapons with transnational reach. More than 20 years after Gilmore first coined [his] turn of phrase, his most notable quotable has effectively been inverted — “Censorship can in fact route around the Internet.” The Internet can’t route around censorship when the censorship is all-pervasive and armed with, for all practical purposes, near-infinite reach and capacity.
brian-krebs  censorship  ddos  internet  web  politics  crime  security  iot 
september 2016 by jm
[Cryptography] Bridge hand record generator cracked
'How to cheat at Bridge by breaking the tournament card-dealing random number generator', via Tony Finch
crypto  security  rngs  prngs  random  bridge  cards  via:fanf 
september 2016 by jm
Google Intrusion Detection Problems
'We have lost access to multiple critical data stores because Google has an automated threat detection system that is incapable of handling false positives.'
google  security  cloud  false-positives  intrusion-detection  automation  fail 
august 2016 by jm
How the NSA snooped on encrypted Internet traffic for a decade | Ars Technica
In a revelation that shows how the National Security Agency was able to systematically spy on many Cisco Systems customers for the better part of a decade, researchers have uncovered an attack that remotely extracts decryption keys from the company's now-decommissioned line of PIX firewalls. The discovery is significant because the attack code, dubbed BenignCertain, worked on PIX versions Cisco released in 2002 and supported through 2009. Even after Cisco stopped providing PIX bug fixes in July 2009, the company continued offering limited service and support for the product for an additional four years. Unless PIX customers took special precautions, virtually all of them were vulnerable to attacks that surreptitiously eavesdropped on their VPN traffic.
nsa  hacks  exploits  pix  cisco  security 
august 2016 by jm
TV detector vans may have been a con all along
This is shaking my world view -- although I find it more plausible that (as responses to https://www.theguardian.com/notesandqueries/query/0,5753,-22440,00.html claim) they _did_ work until about 10-20 years ago, by detecting RF emissions from the local oscillator inside the TV.

Ross Anderson, at https://www.cl.cam.ac.uk/~rja14/Papers/SE-15.pdf , notes:

During [..] World War II, radio engineering saw advances in radar, passive direction
finding, and low-probability-of-intercept techniques, which I’ll discuss in the next
chapter. By the 1960s, the stray RF leaking from the local oscillator signals in domestic
television sets was being targeted by direction-finding equipment in “TV detector
vans,” in Britain, where TV owners must pay an annual license fee that is supposed to
support public broadcast services. Its use has since expanded to satellite and cable TV
operators, who use detector vans to find pirate decoders. Some people in the computer
security community were also aware that information could leak from cross-coupling
and stray RF (see, for example, [259, 791]).
rf  radio  tv  bbc  tv-licenses  tv-license-detector-vans  security  emissions  tempest 
august 2016 by jm
Exit Scam Survival Guide : Buttcoin
Bitcoin lols:
Honesty is most important. Be sure to carefully explain that (excluding the mountain of evidence to the contrary) there was no way to foresee the [Bitcoin] exchange hacking. Practice phrases like, "this operation was the most trustworthy exchange running out of a vacant building in Singapore" and "no we can't just call the exchange, they don't have a phone number". If your significant other criticizes your decision to buy cryptocurrencies, be sure to fall back on technical merits of cryptocurrencies. Mention, "it's backed by math" and "[insert cryptocurrency here] didn't fail, people failed".
bitcoin  buttcoin  lol  funny  cryptocurrency  security  exchanges 
august 2016 by jm
A Cute Internet Star Flirts. All He Wants Is Your Password. - The New York Times
whoa.
Mr. Johnson’s fans are not naïve. Handing over their passwords to some strange, cute boy actually constitutes a minor act of youthful rebellion. The whole encounter delivers a heady mix of intimacy and transgression — the closest digital simulation yet to a teenage crush.


(via Adam Shostack)
via:adam-shostack  passwords  authentication  security  teens  rebellion 
july 2016 by jm
Shopify/ejson
'a small library to manage encrypted secrets using asymmetric encryption.'
The main benefits provided by ejson are:

Secrets can be safely stored in a git repo.
Changes to secrets are auditable on a line-by-line basis with git blame.
Anyone with git commit access has access to write new secrets.
Decryption access can easily be locked down to production servers only.
Secrets change synchronously with application source (as opposed to secrets provisioned by Configuration Management).
Simple, well-tested, easily-auditable source.
crypto  security  credentials  encryption  ejson  json  configuration  config 
july 2016 by jm
E-Voting in Estonia needs to be discontinued
After studying other e-voting systems around the world, the team was particularly alarmed by the Estonian I-voting system. It has serious design weaknesses that are exacerbated by weak operational management. It has been built on assumptions which are outdated and do not reflect the contemporary reality of state-level attacks and sophisticated cybercrime. These problems stem from fundamental architectural problems that cannot be resolved with quick fixes or interim steps. While we believe e-government has many promising uses, the Estonian I-voting system carries grave risks — elections could be stolen, disrupted, or cast into disrepute. In light of these problems, our urgent recommendation is that to maintain the integrity of the Estonian electoral process, use of the Estonian I-voting system should be immediately discontinued.
internet  technology  e-voting  voting  security  via:mattblaze  estonia  i-voting  russia  cybercrime 
june 2016 by jm
Finding pearls; fuzzing ClamAV
great how-to for practical scanner fuzz testing
fuzz-testing  clamav  scanners  security  vulnerabilities  testing 
june 2016 by jm
Stop it with short PGP key IDs!
What happened today? We still don't really know, but it seems we found a first potentially malicious collision — that is, the first "nonacademic" case. Enrico found two keys sharing the 9F6C6333 short ID, apparently belonging to the same person (as would be the case of Asheesh, mentioned above). After contacting Gustavo, though, he does not know about the second — That is, it can be clearly regarded as an impersonation attempt. Besides, what gave away this attempt are the signatures it has: Both keys are signed by what appears to be the same three keys: B29B232A, F2C850CA and 789038F2. Those three keys are not (yet?) uploaded to the keyservers, though... But we can expect them to appear at any point in the future. We don't know who is behind this, or what his purpose is. We just know this looks very evil.
Now, don't panic: Gustavo's key is safe. Same for his certifiers, Marga, Agustín and Maxy. It's just a 32-bit collision. So, in principle, the only parties that could be cheated to trust the attacker are humans, right? Nope.
Enrico tested on the PGP pathfinder & key statistics service, a keyserver that finds trust paths between any two arbitrary keys in the strong set. Surprise: The pathfinder works on the short key IDs, even when supplied full fingerprints. So, it turns out I have three faked trust paths into our impostor.
pgp  gpg  keys  collisions  hashing  security  debian 
june 2016 by jm
The Mitsubishi Outlander vulnerability allows trivial remote car alarm unlocking.
Nearly-open wifi (easily-cracked weak WPA PSK), and a 6-byte string to disable the car alarm, discovered via replay attack. Massive fail
internetofshit  mitsubishi  fail  outlander  wpa  alarms  security  replay-attack 
june 2016 by jm
Live Streaming Security Games
Rapid Fire is a special event we started hosting at our own in-person CTFs in 2014. The idea is pretty simple:

Create several CTF challenges that can be solved in a few minutes each.
Set up the challenges on 4 identical computers with some basic tools.
Mirror the player’s screens so the audience can watch their actions.
Whoever solves the most challenges the fastest wins.

This event is interesting for a number of reasons: the players are under intense pressure, as everything they do is being watched by several people; the audience can watch several different approaches to the same problems; and people can follow along fairly easily with what is going on with the challenges.


With e-sports-style video!
gaming  hacking  security  e-sports  streaming  twitch  ctf 
may 2016 by jm
100 thieves steal $13m in three hours from cash machines across Japan
'Police believe that as many as 100 people, none of whom have been apprehended, worked together using forged credit cards containing account details illegally obtained from a bank in South Africa. The culprits used the fake cards at 1,400 convenience store automated teller machines on the morning of 15 May, according to police. Each made a single withdrawal of 100,000 yen – the maximum allowed by the cash machines.'

1,600 forged/stolen credit card credentials from a single bank, then a synchronised attack made possible by the eventually-consistent ledger model of ATM accounting.

(via William Gibson)
atms  banking  japan  fraud  security  credit-cards 
may 2016 by jm
Bike thief reveals tricks of the trade in this shockingly candid interview
This is an eye-opener:
A former bicycle thief has revealed the tricks of the trade in an interview, which clearly and shockingly shows the extent that thieves will go to in order to steal a bike. He talks about the motivations behind the theft, the tools used to crack locks and how the bikes were moved around and sold for a significant sum. He also gives tips on how to prevent your bike from being stolen.
[...]

'Don’t be fooled by Kryptonite locks, they’re not as tough as made out to be. Also D-bars with tubular locks, never use them, they’re the most easy to pick with a little tool. It’s small and discreet, no noise and it looks like you are just unlocking your bike. With the bolt cutters we would go out on high performance motorbikes, two men on a bike.'
bikes  locks  bike-locks  security  london  theft  lockpicking  d-locks 
may 2016 by jm
​Why I Hate Security, Computers, and the Entire Modern Banking System | Motherboard
I am honestly amazed the US banking system still works this way, after over a decade of rampant identity theft:
I cannot count the number of times I’ve freely given out my routing and account numbers—in emails, in webforms, in paperwork. This is because it’s necessary for other people to know my routing number and account number in order for them to send me money. But apparently, with that same information, they can also snatch money straight from my account. What kind of insane system is this? There’s two factor authentication, there’s one factor authentication, and then there’s this, which I think I can call zero factor authentication.
identity-theft  phishing  banking  banks  usa  authentication  2fa  0fa  security 
may 2016 by jm
Exclusive: SWIFT bank network says aware of multiple cyber fraud incidents
"SWIFT is aware of a number of recent cyber incidents in which malicious insiders or external attackers have managed to submit SWIFT messages from financial institutions' back-offices, PCs or workstations connected to their local interface to the SWIFT network," the group warned customers on Monday in a notice seen by Reuters.


Ouch. They seem to be indicating that they're all phishing/impersonation-based attacks.
phishing  swift  banking  hacks  exploits  banks  security 
april 2016 by jm
How I Hacked Facebook, and Found Someone's Backdoor Script
Great writeup of a practical pen test. Those crappy proprietary appliances that get set up "so the CEO can read his email on the road" etc. are always a weak spot
facebook  hacking  security  exploits  pen-tests  backdoors 
april 2016 by jm
Detecting the use of "curl | bash" server side
tl;dr:
The better solution is never to pipe untrusted data streams into bash. If you still want to run untrusted bash scripts a better approach is to pipe the contents of URL into a file, review the contents on disk and only then execute it.
bash  security  shell  unix  curl  tcp  buffers 
april 2016 by jm
The problems with forcing regular password expiry

The new password may have been used elsewhere, and attackers can exploit this too. The new password is also more likely to be written down, which represents another  vulnerability. New passwords are also more likely to be forgotten, and this carries the productivity costs of users being locked out of their accounts, and service desks having to reset passwords.
It’s one of those counter-intuitive security scenarios; the more often users are forced to change passwords, the greater the overall vulnerability to attack. What appeared to be a perfectly sensible, long-established piece of advice doesn’t, it turns out, stand up to a rigorous, whole-system analysis. CESG now recommend organisations do not force regular password expiry.
cesg  recommendations  guidelines  security  passwords  expiry  uk  gchq 
april 2016 by jm
Canadian Police Obtained BlackBerry’s Global Decryption Key in 2010
According to technical reports by the Royal Canadian Mounted Police that were filed in court, law enforcement intercepted and decrypted roughly one million PIN-to-PIN BlackBerry messages in connection with the probe. The report doesn't disclose exactly where the key — effectively a piece of code that could break the encryption on virtually any BlackBerry message sent from one device to another — came from. But, as one police officer put it, it was a key that could unlock millions of doors.
Government lawyers spent almost two years fighting in a Montreal courtroom to keep this information out of the public record.
canada  crime  encryption  security  blackberry  crypto  rcmp  police  rogers  montreal  rim 
april 2016 by jm
Data Protection Mishap Leaves 55M Philippine Voters at Risk
Every registered voter in the Philippines is now susceptible to fraud and other risks after a massive data breach leaked the entire database of the Philippines’ Commission on Elections (COMELEC). While initial reports have downplayed the impact of the leak, our investigations showed a huge number of sensitive personally identifiable information (PII)–including passport information and fingerprint data–were included in the data dump. [....]

Based on our investigation, the data dumps include 1.3 million records of overseas Filipino voters, which included passport numbers and expiry dates. What is alarming is that this crucial data is just in plain text and accessible to everyone. Interestingly, we also found a whopping 15.8 million record of fingerprints and a list of people running for office since the 2010 elections.

In addition, among the data leaked were files on all candidates running on the election with the filename VOTESOBTAINED. Based on the filename, it reflects the number of votes obtained by the candidate. Currently, all VOTESOBTAINED file are set to have NULL as figure.

fingerprints  biometrics  philippines  authentication  data-dumps  security  hacks  comelec  e-voting  pii  passports  voting 
april 2016 by jm
Neutered RNG let man rig million dollar lotteries | Ars Technica
A forensic examination found that the generator had code that was installed after the machine had been audited by a security firm that directed the generator not to produce random numbers on three particular days of the year if two other conditions were met. Numbers on those days would be drawn by an algorithm that Tipton could predict [...] All six prizes linked to Tipton were drawn on either Nov. 23 or Dec. 29 between 2005 and 2011.
prng  randomness  security  hacks  exploits  lottery  us  audits  holes 
april 2016 by jm
Irish drone register allowed access to personal details of 2,000 members
The breach, which allowed registered users to view names, addresses, email addresses and phone numbers of other people registered on the site, was brought to the attention of the authority on Sunday night.
In a statement to TheJournal.ie, the IAA revealed it was aware of four users who downloaded the file.
fail  drones  ireland  iaa  security 
april 2016 by jm
GCHQ intervenes to prevent catastrophically insecure UK smart meter plan - The Inquirer

GCHQ barged in after spooks cast their eyes over the plans and realised that power companies were proposing to use a single decryption key for communications from the 53 million smart meters that will eventually be installed in the UK.


holy crap.
gchq  security  smart-meters  power  uk  electricity  gas  infrastructure 
april 2016 by jm
'Devastating' bug pops secure doors at airports, hospitals
"A command injection vulnerability exists in this function due to a lack of any sanitisation on the user-supplied input that is fed to the system() call," Lawshae says.


:facepalm:
security  iot  funny  fail  linux  unix  backticks  system  udp  hid  vertx  edge 
april 2016 by jm
« earlier      
per page:    204080120160

related tags

0fa  2fa  3db  3des  3dsecure  3g  4chan  4g  9-11  512-bit  a350  a380  abuse  accidents  accounts  accuracy  acid  acidrain  aclu  actel  activism  ad-trackers  admin  ads  adversarial-attacks  advertising  advice  aes  aggregation  ai  aib  air-gap  air-gaps  air-travel  airborne-zombies  aircrack  airport  akamai  alarm  alarms  alert  algorithms  allcrypt  amazon  america  amplification  android  anonymisation  anonymity  anonymization  anonymous  anti-phishing  anti-spam  antivirus  antwerp  ap  apache  apache-harmony  api-keys  apis  apple  applets  appliances  apps  arab-spring  arch-linux  architecture  ars-technica  as-34109  asf  ashleymadison  atm  atms  attack  attacks  auditing  audits  australia  austria  auth  authentication  authorisation  authorization  authy  auto-learning  automation  autonomous-vehicles  av  avast  aviation  avionics  avs  aws  backbone  backdoors  backticks  backup  backups  banking  banks  bash  bastions  bbc  belkin  ben-goldacre  bernie  bernie-bros  bgp  bidi  big-brother  big-data  bike  bike-locks  bikes  biometrics  bios  birthday  birthday-paradox  birthday-problem  bitcoin  bitomat  blackberry  blacklists  blockchain  blocking  blue-coat  bluetooth  boeing  books  bordeaux  botnet  bots  bpf  brakes  brian-krebs  bridge  broadcast  browsers  bruce-schneier  brute-force  bsafe  bsd  btc  buffer-overflows  buffer-overrun  buffers  bug-reports  bugging  bugs  bugzilla  build  burner-phones  buttcoin  byte  c  ca  cacerts  caching  calculators  calibre  cameras  can  can-bus  canada  cao  card-present  cards  cars  case-studies  casinos  cassandra  cauce  cb3rob  cbc  ccc  ccleaner  cctlds  celebrities  celebs  cellphones  cellxion  censorship  certificates  certs  cesg  cgi  characters  chef  children  china  chip-and-pin  chip-and-signature  chipandpin  chips  chrome  chrysler  chunked-encoding  cia  cifas  cipav  cisco  citizen-lab  cityhash  clamav  clampi  classification  clocks  clojure  cloud  cloud-services  cloudflare  clowns  cnbc  cnnic  code-spaces  codepad  codepoints  coding  coding-standards  coffee-machines  cold-war  colin-holder  collisions  comcast  comelec  comerica  command-and-control  communication  comodo  compartmentalisation  compliance  compression  computers  concurrency  config  configuration  connecticut  connectivity  console  contactless  containerization  containers  contractors  control-characters  cookies  copying  corvil  cory-doctorow  counter-terrorism  coursera  courtventures  cpu  cracking  credentials  credit  credit-cards  credit-freeze  credstash  crime  crl  crls  crowdsourcing  crypto  crypto-ag  cryptocurrency  cryptography  cryptophone  cs  css  ctf  ctr  cuban-missile-crisis  culture  curl  currency  customer-care  customer-support  cve  cyber-attacks  cyber-war  cybercrime  cyberpower  cyberwar  cycling  cydia  d-link  d-locks  d-spam  d1000  dailywtf  dan-kaminsky  danger  daniel-solove  darknet  data  data-breaches  data-dumps  data-leak  data-privacy  data-protection  data-retention  database  databases  datamining  datavis  date-of-birth  david-miranda  david-simon  ddos  deanonymization  death  debian  debit-cards  debugging  defaults  defcon  delegation  delete  dependencies  deployment  des  desfire  design  desktop-sharing  dessid  development  devices  dhs  dick-cheney  diffie-hellman  digicert  digital-rights  directories  discrimination  distraction  distribution  diy  djb  dkim  dmca  dnc  dns  dnsbls  docker  doh  domain-keys  domains  dorking  dos  dosage  dot-io  dot-net  dpc  dreamliner  driving  drm  drones  dropbox  drown  drug-pumps  drugs  dsl  dual-ec-drbg  dual-use  dual_ec_drbg  dublin  dug-song  dvb  dvb-s  dvb-t  dvcs  e-sports  e-voting  east-texas  eastern-europe  eavesdropping  ec2  ecb  ecc  ecdhe  echo  ecommerce  ecs  edge  editors  eff  eir  eircom  ejson  elb  elections  electricity  electronics  elliptic-curve  elliptic-curves  email  embedded-systems  emergency  emissions  emr  emrfs  emv  encryption  end-to-end  entropy  epic-marketplace  epsilon-interactive  eric-brandwine  error-checking  escaping  esp  espionage  essay  estonia  ethereum  ethics  eu  eurion  euro  europol  ev  events  evidence  exchanges  exfiltration  experian  expiry  exploits  extortion  facebook  facebook-api  factorisation  fail  fail0verflow  false-positives  fappening  farebot  fastmail  fbi  fca  fghack  fiat  filesharing  filtering  finance  financial  find-my-iphone  fine-gael  fingerprinting  fingerprints  firefox  firewall  firewalls  firmware  five-eyes  flame  flash  flight  floating-point  foscam  fpga  france  fraud  freak  freebsd  fridges  frontline  froyo  ftp  fun-cards  funding  funny  fuse  future  fuzz-testing  fuzzing  gadgets  gambling  games  gaming  gandi  gartner  gas  gas-stations  gce  gchq  gemalto  gentoo  germany  git  gke  glue-records  gmail  gnu  google  google-cloud  goto  goto-fail  government  gpg  gpl  grades  gradle  great-cannon  great-firewall  greatfire  grsecurity  gsm  gsmem  gsocgate  guardian  guidelines  gwibber  hackers  hacking  hacks  hadoop  hamachi  han  handshake  haproxy  hard-lattice-problem  hardware  hash  hash-collision  hashdos  hashes  hashicorp  hashing  hashmap  hbgary  hc-05  health  heartbleed  hid  hijacking  hilary-clinton  history  history-stealing  hmac  hmrc  holes  home  home-alarms  home-automation  homebrew  homeplug  horror  horror-stories  hospira  house  html  http  https  humor  hvac  hyperdex  hypervisor  i-voting  iaa  iam  icann  icloud  ics  id-cards  id-numbers  identity  identity-theft  idiots  ieee  ifso  ikydz  ilya-grigorik  images  imaging  imei  immixgroup  imsi-catchers  india  inept  infrastructure  injection  input  instagram  install  insteon  insulin  integrity  intel  internet  internet-voting  internetofshit  intrusion-detection  ioactive  ioerror  ios  iot  ip  ipad  iphone  ipmi  ipsec  iran  irc  ireland  isec  isolation  isps  israel  jailbreaking  jails  jamming  japan  jar  jars  java  javascript  jdk  jeeps  jenkins  jira  jmx  joe-stewart  jon-callas  jonathan-zdziarski  journalism  json  jtag  juniper  jvm  kaptoxa  karma-police  karsten-nohl  kernel  kettles  key-distribution  key-length  key-lengths  key-management  key-rotation  keybase  keybox  keyed-hashing  keyless  keyless-entry  keyloggers  keyraider  keys  keyservers  keywhiz  kids  kiosks  kiss  kms  knife  kompromat  korea  krack  kubernetes  l2tp  languages  las-vegas  lastpass  latency  launch-codes  law  law-enforcement  lawsuits  leaf  leaks  legacy  lenovo  liability  libbfd  liberty  libraries  limits  linkedin  linux  location  lockpicking  locks  logging  lol  lols  london  lottery  lucid-intelligence  lxc  mac  macaroons  machine-learning  maciej  macron  magstripe  mail  malware  mandos  maritime  mastercard  matt-blaze  matthew-green  maven  mcafee  md5  measurement  medicine  medoc  memcached  memory  memory-cards  metadata  metrics  mfa  michael-hayden  microsemi  microsoft  mifare  mig  mike-hearn  miniduke  mining  mitm  mitsubishi  mobile  mobile-phones  moderation  money  montreal  moores-law  mounir-mahjoubi  mouse-jacking  movies  mozilla  msg_peek  mtgox  mugging  murmurhash  muscular  mysore  n26  nai  namespaces  ncsc  neorouter  netbios  network  network-monitoring  network-neutrality  networking  new-york  newegg  nginx  nissan  nlp  nmap  node  north-korea  nosql  not-the-onion  notaries  notpetya  npm  nsa  nsls  nsw  ntp  nudes  nukes  nul  nyc  nyetya  nyms  nytimes  o2  oath  oauth  obfuscation  obscurity  ocsp  off-means-off  offshoring  oilrigs  okinawa  omgwtfbbq  one-time-passwords  online  online-backup  online-banking  online-shopping  online-storage  online-voting  open-source  openbsd  opensource  openssh  openssl  openwrt  operability  opie  opportunistic  ops  opt-out  oracle  osx  ota  otp  outlander  owasp  p2p  pacemakers  packages  packaging  packet-capture  packet-injection  packets  pal  paper  papers  parity  passports  passwords  pastebin  patent-trolls  patents  pathetic  pattern-analysis  payment  paypal  pci  pci-dss  pdf  pea  peering  pen-tests  per-thorsheim  perfect-forward-secrecy  performance  peter-bailis  petrol-stations  pgp  phil-zimmermann  philippines  philosophy  phish  phishing  phones  photos  photoshop  php  pics  pii  pin  pins  piracy  piriform  pix  pki  plainscapital  planes  planex  playstation  plcs  plex  plugins  point-of-sale  poisoning  police  policies  politics  popen  port-forwarding  pos  posram  post-its  postmortems  poul-henning-kemp  power  power-amplifiers  power-management  powerline-networking  prefetching  primes  prism  prius  privacy  private-keys  prng  prngs  probability  programming  project-zero  protocols  proxies  proximity  proxy  proxying  ps3  ps4  psc  psn  public-key  pump  putin  pypi  python  quakenet  qualcomm  quic  racism  radio  rails  rainbow-tables  ram-scrapers  ramnica-valcea  random  random-forests  randomness  ransomware  raspberry-pi  rcmp  rebellion  recommendations  reddit  reference  regin  regulation  reinvent  remote  replay-attack  replay-attacks  replication  reports  resilience  resource-limits  return-oriented-programming  reverse-engineering  reversing  review  revocation  rf  rfid  rick-falkvinge  rim  riscs  risk  risks  rlo  rmi  rng  rngs  road-safety  robin-xu  rogers  role-accounts  romania  root  rop  ross-anderson  router  routers  routing  rsa  ruby  runa-sandvik  russia  rvm  s3  safe-browsing  safety  salting  samsung  samy-kamkar  sandbox  sandboxing  sandstorm  sanitisation  sanitization  satellite  satis  scala  scaling  scams  scanner  scanners  scanning  scareware  scary  schneier  science  screening  sd-cards  sdn  search  searching  secrecy  secrets  securecode  secureworks  security  security-theatre  security-through-obscurity  seizure  self-driving  serialization  server  servers  setuid  sh  sha  sha1  sha256  shell  shellshock  shipping  ships  shodan  shopping  shoup  side-channels  siemens  sigint  signal  silent-circle  silentcircle  silicon  sim-cards  siphash  skey  skimmers  skimming  slashdot  slides  slot-machines  smart-cars  smart-meters  smart-tvs  smartcards  smartphones  smb  smc8014  sms  snapchat  snes  sniffing  snooping  social-media  society  software  solarcapture  solaris  sony  source-code  south-africa  south-korea  spam  spamhaus  spear-phishing  speech  speed  spinvox  spoofing  spotify  spying  spyware  sql  square  ss7  ssh  sshd  sshuttle  ssl  ssl-labs  ssl3  sslv2  ssn  standards  statistcs  statistics  stingrays  stock-markets  storage  streaming  strings  sts  stud  stuxnet  super-mario  superfish  superget  surveillance  svm  swift  swpats  symantec  syn  sync  sysadmin  sysadmins  system  systemd  talos  tao  target  taxis  tcp  tcpcrypt  tcpdump  tcpip  tech  technology  teens  telefonica  telegraph  telegraphes-chappe  teleport  tempest  terrorism  tesco  testing  tests  text  the-guardian  the-interview  theft  thomas-ptacek  thunderbird  time  time-warner  timing  tips  tlds  tls  tlsdate  toasters  tog  tomato  tools  tor  torrents  totp  tou  toyota  tr-064  tracking  transactions  transcription  transit  transparent-proxies  travel  trend-micro  trojan.posram  trojans  truecrypt  trump  trust  trustwave  tsa  tunisia  tunneling  tunnelling  turing-complete  turla  tv  tv-license-detector-vans  tv-licenses  tv5monde  twitch  twitter  two-factor-auth  two-factor-authentication  typos  u-locks  u2f  ubuntu  uconnect  udp  ui  uk  ukraine  unicode  unit-testing  unix  upd4t3  updates  upgrades  urllib  urls  us  us-politics  usa  user-submitted-code  usertrust  v2v  varnish  vault  vaults  vbv  vc  verification  verified-by-visa  version-control  vertx  via:adam-shostack  via:adamshostack  via:adulau  via:alec-muffet  via:boingboing  via:bruces  via:cscotta  via:elliottucker  via:eric  via:fanf  via:filippo  via:gwire  via:hn  via:ioerror  via:irr  via:jgc  via:joe-feise  via:johnke  via:jzdziarski  via:kragen  via:lhl  via:mattblaze  via:mikko  via:nelson  via:oisin  via:pixelbeat  via:pjakma  via:reddit  via:risks  via:securitay  via:tupp_ed  via:waxy  via:zeynep  vin  viruses  visa  vlans  vm  voting  vpc  vpn  vulnerabilities  vulnerability  vvat  waf  walmart  war  warning  watchlists  web  web-of-trust  web-services  webdev  webkit  wemo  wep  whatsapp  whitelisting  whitepapers  whitfield-diffie  wickr  wifi  wikileaks  windows  windows-xp  winvote  wired  wireless  wordpress  worms  wow  wpa  wtf  wyoming  x-ray  xelerance  xl2tpd  xss  yale  yubikey  zeynep-tufekci  zwj  zyxel 

Copy this bookmark:



description:


tags: