End-to-End: Google will mit Javascript verschlüsseln - Golem.de. You can think what you want about Google, but there are still technicians with brains there who sometimes build something cool. Of course, we'll have to see how well the whole thing is implemented, but if someone like Google offers PGP integration for Gmail, that could finally be the impetus for the topic to gain further traction. The biggest problem with PGP and similar things is still the availability of communication partners who can actually do something with the corresponding technology.
sicherheit
Tails - About Tails. Hmm, maybe set up a USB stick with the system, for on the go and as needed.
Port 32764: Cisco confirms backdoor in routers. Ok, they confirm the existence - but where is the explanation, where it comes from? Why is it there and why hasn't Cisco removed it long ago? Does anyone seriously want to tell me that Cisco would never run a port scan on their own routers?
TeleHash / JSON + UDP + DHT = Freedom. Discovered via git-annex: a distributed messaging technique with interesting properties. Strongly P2P-oriented, strongly focused on encryption, and designed from the outset as middleware rather than primarily as a human-to-human protocol like XMPP. Definitely worth watching what comes out of this.
Matasano Security - Matasano Web Security Assessments for Enterprises. Analysis of cryptography in JavaScript. Summary: Cryptography in JavaScript is usually a bad idea, as the JavaScript is loaded from an untrusted source or untrusted network (if you trusted it, cryptography would hardly be necessary) and therefore a chicken-and-egg problem exists. Regarding the previous 0bin project: cryptography was not implemented to secure the user, but to secure the 0bin operator - it is therefore relatively irrelevant to the operator whether users are secure or not, it is only about "plausible deniability" for the operator. The situation is different, however, when a JavaScript encryption is implemented instead of using SSL.
Chrome can be cracked in five minutes | Products | futurezone.at: Technology-News. Oy Gevalt! I think some people need to rethink things now. No, sandboxing is not a guaranteed solution for security, it is at best a single component of a complete solution. And yes, making programs more complex also increases the complexity of the security situation. And eventually, there will be a breakthrough like this. (and no, the other browsers are no better, Chrome was just considered "secure" for longer and after the last Pwn2Own it was considered "uncrackable" by some)
Google Wallet PIN cracked on rooted Android devices | The Verge. Well, that was quick. I can't help but smirk. Google should really have better people implementing such things.
BUSTED! Secret app on millions of phones logs key taps • The Register. Net - Android phones infected with rootkit/keylogger. And if I read that correctly, the software was apparently installed by network providers and/or device manufacturers. Oh, of course, it's just a "diagnostic tool" - just like the various trojans for PCs are only remote maintenance tools ...
Security flaw: Fire hazard with HP printers? - Golem.de. Finally able to remotely burn down offices. Surely every hacker dreams of that. Thanks HP for this extremely useful feature.
CCC | Chaos Computer Club analyzes current version of the state trojan. Well, well, the current state trojan is just as bad as the alleged prototype. And of course, everyone claims not to use it. So what is the wonderful, legally compliant version of the state trojan that is allegedly used in the authorities? It would be interesting if the authorities would provide this trojan to the CCC for analysis. But that would be honest and transparent behavior. Apparently, we can no longer expect that from authorities in our banana republic.
Firewire Attacks Against Mac OS Lion FileVault 2 Encryption » frameloss. Apple must have made a huge mistake here. Because via Firewire DMA, one can access the password for full-disk encryption stored in main memory. Even if you have disabled auto-login and there is actually no reason to have the password in memory. Ouch.
The strange facts of Mr. Uhl « mrtopf.de. I'll just say: read. Because why should I repeat everything that someone has already written elsewhere. And since it also concerns data protection with the VDS, also categorized for the Metaeule.
SSL and Cookies in WordPress 2.6 « Ryan Boren. Although originally written for WordPress 2.6, it is still valid. I had to do a bit of hacking, as my WordPress server is not directly connected to the network, but behind a firewall (iptables with DNAT helped), but now I have properly secured admin cookies and am better protected against WLAN sniffers at public hotspots. The WordPress idea is really nice - not 100% security, as with my login cookie comments can still be posted under my name, but at least the administration is protected. However, it conflicts with the Safer Cookies Plugin, which I previously used to at least pin my cookies to the IP. Additionally, there is a patch that has gone through 3.1 and enables securing the login cookie as well.
Hackers broke into Lockheed Martin. Holy cow, worst case scenario. Who bets that now cybersecurity laws in the USA will be tightened, after attacks on companies in the defense industry can presumably be portrayed as a matter of national security?
Dropbox Lied to Users About Data Security, Complaint to FTC Alleges. Just a reminder: anyone using something like Dropbox (or any of the other services with similar functionality) should encrypt client-side (on Macs, sparse bundles are suitable), if it's critical or personal content. Because even if a service promises to encrypt everything and no one can read the data, this service can simply lie. Or have a wrong implementation. The deduplication, the folder sharing and the fact that for some versions a public URL is generated for each file - and thus in both cases people get access to files to whom you have not revealed your password - should make it clear that Dropbox must be able to decrypt server-side. Which of course does not make the wrong presentation on their advertising pages any better - yes, it was just omitting information, but with security statements you'd better say a bit more to make it clear what you actually guarantee. If you leave out essential information, you should not be surprised if you (rightfully!) are called a liar. And especially in the USA, something like this could put a company in quite a predicament.
Serious PSN hack: Personal customer data copied. Now it's out why PSN was offline for so long (not that it affected me particularly - I don't have a PlayStation - but the silence around the downtime was quite strange).
Microsoft Shuts off HTTPS in Hotmail for Over a Dozen Countries | Electronic Frontier Foundation - a villain who thinks evil about it. Surely pure coincidence that the list of affected countries reads like the "elite" of democratic states. The hypocrisy of large corporations is actually only surpassed by FDP economic ministers.
By adding extra code to a digital music file, they were able to turn a song burned to CD into a Trojan horse. When played on the car's stereo, this song could alter the firmware of the car's stereo system, giving attackers an entry point to change other components on the car.
via With hacking, music can take control of your car | ITworld.
Advanced sign-in security for your Google account - Official Gmail Blog. Generally a good idea, as it makes the login - when used correctly - really more secure. But whether one overcomes one's inner laziness and actually uses it ... (I'm not even sure if I want to do this for my email)
Bug 1044 – CVE-2010-4345 exim privilege escalation. The second part of the Exim march. This is the privilege escalation via Exim and an alternative config file. Because Exim is a monolithic server running under suid rights (i.e., starts with root rights even if executed as another user), there is a small time window in which the service always runs as root - and this is exploited through the alternative config file. The patch restricts the locations where these config files may reside and, combined with the configuration of write permissions on this location, can prevent non-root users from injecting their own configs.
Bug 787 – memory corruption in string_format code. Important if you're running a Debian version older than Lenny, as there are no more security updates available and you have to patch it yourself. This one closes the door. By the way, it's quite interesting to look at the date - it has been fixed since 2008, but due to the early discontinuation of security updates for outdated Debian releases, it is still present in many Debian systems based on Etch (and older). Debian is only recommended for use if you can actually keep up with every release change in a timely manner. Otherwise, solutions like Ubuntu LTS are by far the better choice. Apart from that, it's quite embarrassing that Lenny still had such an outdated Exim ...
HP Storage Hardware Harbors Secret Back Door | threatpost - hopefully puts an end to the regular "we need to switch to HP because it's much better than NetApp" discussions. And yes, that was sarcasm.
Security: Alleged Backdoor in OpenBSD's IPSEC Stack. Ouch. If there's anything to it, we might need a WikiLeaks for Open Source. And of all places, in OpenBSD, which has put security at the top of its TODO list.
"A bomb on a plane heading to Germany? Admittedly, I'm just a science journalist, deal with physical phenomena, but frankly, I don't believe this news. It all fits too well. Here in my hotel are the interior ministers, and precisely now it is announced that Germany will soon be the target of a terrorist attack. This smells like a staged event."
via With de Maizière at the breakfast table: The terror is here, the muesli is gone - taz.de.
Security Researchers: Paying with Credit Card and PIN Insecure - Golem.de - but apparently paying with EC cards is absolutely secure.
Please read: Security Issue on AMO « Mozilla Add-ons Blog - it was only a matter of time before the first Firefox extensions with trojans were distributed and slipped through Mozilla's review. Extensions are exactly that - code snippets that run in the same security context as Firefox itself. I believe that in the long run, we need a completely different architecture with much stronger sandboxing for applications and extensions if we want to get this under control.
Windows hole discovered after 17 years - well, that's a nice greeting from the past. Privilege escalation in the old DOS boxes - back to NT 3.1!
Matasano Security LLC - Chargen - If You're Typing The Letters A-E-S Into Your Code, You're Doing It Wrong - interesting article (even if in a somewhat strange presentation form) about typical problems with the use of cryptography for SSO in web systems. Simply "I encrypt the cookie and then everything is fine" just doesn't cut it ...
Study shows viral SSIDs could be creating a massive wireless botnet Tech Sanity Check TechRepublic.com - and some more about viral SSIDs and a small list of SSIDs that have appeared in this context. I came across it because a friend of mine has one of the networks (hpsetup) near her and wondered where the SSID came from.
Viral SSID - WLAN/Wireless Security Knowledge Center - interesting. SSIDs from WLAN networks as an attack vector for computers.
Privacy of 3.5 Billion Cellphone Users Compromised – GSM Code is Broken | ProgrammerFish - well, that's it for GSM, eavesdropping made easy. As the article correctly states: there should have been updates to the encryption of GSM a long time ago, it's simply negligence in the design of the technology that updates to the encryption were not planned from the outset. It will be interesting to see when this becomes a bigger issue and telecom companies are forced to take action.
Either Mark Zuckerberg got a whole lot less private or Facebook’s CEO doesn’t understand the company’s new privacy settings. - well, that's a surprise. (in my case, things are open because my Facebook profile serves only as a super aggregator, collecting almost exclusively public content, so stricter security settings don't make much sense there)
Government smartphones run on Windows Mobile - because, as is well known, it is so super secure and there are no backdoors in the system. After all, the entire system can be easily subjected to an audit. Ooops. Oh, and particularly cute is the decision for HTC Windows Mobile smartphones, after HTC itself announced that in the future, the new devices will primarily be released with Droid (which could realistically be subjected to an audit). Then HTC can sell its remaining inventory to the government at a high price.
Electric Alchemy: Cracking Passwords in the Cloud: Breaking PGP on EC2 with EDPR - interesting article about brute-force cracking of passwords using dynamic instances on Amazon EC2. Particularly interesting is the second part with the analysis of the costs of this solution depending on password complexity and length. 8-character passwords (even with special characters and numbers) are definitely no longer up-to-date for really sensitive data.
One bug to rule them all - JavaScript, cross-platform. Wow.
iPhone to Get SMS Vulnerability Fix - autsch. autsch. autsch.
"Secure Identity = Unique Identity" - "He is convinced that citizens' informational self-determination can be better protected by new technologies, so one should not always see such systems as a threat scenario." - could it be because the protection of informational self-determination has no place at all in their entire presentation? Why is it repeatedly claimed without any basis that something protects informational self-determination, when there is no evidence or concrete example for this? A bit more care in lying would really be appropriate.
WPA allegedly crackable in less than 15 minutes - Holy Cow!
Bundestag's election inspector calls voting computers secure - why are our politicians always struck by particularly great stupidity? Isn't Hansel even able to read current press, where even in the USA states are backpedaling on the topic of voting computers, where the manufacturers of these devices had to take such massive image losses that one even changed its name? Not to mention all the incidents in Europe and the good coverage of the topic by the CCC? Are only dumb idiots getting jobs in the government? Shouldn't the protection of one of the most important democratic means - for the politicians: I'm talking about elections, not about the allowances - be particularly worthy of protection and in case of concrete indications of insecurity, rather play it safe and go with paper+pen?
US Intelligence Agencies: Terrorists Could Use Online Role-Playing Games to Plan Attacks - Ongoing summer doldrums debate in the USA? Don't they have a few banks and insurance companies to worry about? The impact of a collapse at AIG would certainly be much greater than these movie horror scenarios that some self-important people come up with. Unfortunately, such theorists with their contrived nonsense are increasingly found here as well. Instead of dealing with real dangers (when will there finally be a speed limit on highways?), more and more absurd proposals on the topic of surveillance are coming up, which will classically protect us from non-existent problems. And money is then spent on such nonsense ...
The Associated Press: States throw out costly electronic voting machines - only here do we still believe the manufacturers' lies more than the experts. There are no unhackable computers. As already in XKCD: "anti-virus programs on voting machines? You are doing it wrong."
Apple just gave out my Apple ID password because someone asked - ouch. Very poor show, Apple.
Keylogger in JavaScript with IE up to version 8beta - ouch. That hurts. And I wonder again why one has to install such essential functions as NoScript via extension even with Firefox. Such things belong as basic tools directly into every browser. And no, the simple on/off for JavaScript, which is offered, is no alternative - in times of Ajax interfaces you need JavaScript again and again.
Revision3 DOS - "First, they willingly admitted to abusing Revision3’s network, over a period of months, by injecting a broad array of torrents into our tracking server. They were able to do this because we configured the server to track hashes only – to improve performance and stability. That, in turn, opened up a back door which allowed their networking experts to exploit its capabilities for their own personal profit." - ein Handlanger der Musik und Filmindustrie legt einen legalen Betreiber eines Torrent-Trackers lahm. Da sieht man schön, mit welchen dreckigen Methoden (z.B. Diensteerschleichung) diese Leute arbeiten. Aus dem Nebensatz "das FBI interessiert sich dafür" entnehme ich mal, dass Anzeige erstattet wurde. Gut.
Final farewell to voting computers in the Netherlands - Golem.de - "The Dutch Ministry of the Interior announced the final farewell to voting computers on Friday. In the future, citizens in the country will once again cast their votes with pen and paper. The Dutch Council of Ministers was prompted to make this decision after massive security vulnerabilities in the voting computers were proven last year. The Chaos Computer Club (CCC) demonstrated in mid-2007 how the ROM memory of a Nedap computer can be replaced with a manipulated ROM within 60 seconds. Researchers and the civil rights initiative "Wij vertrouwen stemcomputers niet" ("We do not trust voting computers") had demonstrated further security vulnerabilities." - wouldn't it be great if our politicians would react similarly? However, this is less likely to be expected.
Consequences of the SSH/SSL weakness - clear words about the impact of the bug. Only 32767 different keys were generated for the machines during the time the defective OpenSSL version was in use (at least since spring 2007, if you were on stable). Ouch.
Debian OpenSSL Predictable PRNG Toys - and here are the matching toys to play with the hole. Generating the 32767 keys for various key architectures.
Debian and OpenSSL: The Aftermath - for anyone who has doubts whether they need to recreate their keys: "However, rather than fix the calls to RAND_add(), the Debian maintainer instead removed the code that added the buffer handed to ssleay rand add() to the pool. This meant that the pool ended up with essentially no entropy. Clearly this was a very bad idea." - yes, "essentially no entropy" when generating keys is a really bad idea. Ouch.
Vendors Are Bad For Security - about the "bugfix" in Debian that has made all generated OpenSSL keys more or less unusable since 2006. Thanks for the extra work, you idiots. Funny also the comments in which the OpenSSL developer gets his own rant stuffed back down his throat because the OpenSSL idiots did not deem it necessary to deal with the fix suggested by the Debian developers (except for one who actually signaled thumbs-up). Well. All software sucks.
Phishers go on whale hunting with summonses - well, in order to distribute a trojan, one simply targets the dumbest users imaginable: either men looking for porn, students and pupils looking for homework material suitable for plagiarism, or business managers (and in the latter case, some interesting information might even be found - among other things, perhaps the overlap with the first group?). In any case, we now know how Schäuble wants to get the Bundestrojaner installed.