Clik here to view.
OCaml-TLS: the protocol implementation and mitigations to known attacks
This is the fifth in a series of posts that introduce new libraries for a pure OCaml implementation of TLS. You might like to begin with the introduction.ocaml-tls is the new, clean-slate...
View ArticleClik here to view.
Puffin Web Browser Address Bar Spoofing Vulnerability (Puts millions of users...
During my recent research on Mobile browsers i have managed to find couple of interesting vulnerabilities such as SOP bypass, Denial of service and Address bar spoofing vulnerability which are worth...
View ArticleClik here to view.
xxHash - Extremely fast hash algorithm
xxHash is an Extremely fast Hash algorithm, running at RAM speed limits. It successfully passes the SMHasher Test suite evaluating Hash quality.more...
View ArticleClik here to view.
Hacking POS Terminal for Fun and Non-profit
Point-of-Sale (POS) devices are an essential part of modern life; the blood line for merchants. As plastic payment cards have become the default payment method, the security of POS devices has become...
View ArticleClik here to view.
MITMf
Framework for Man-In-The-Middle attacksThis tool is completely based on sergio-proxy https://code.google.com/p/sergio-proxy/ and is an attempt to revive and update the project.more...
View ArticleClik here to view.
The Dragonfly Attack
At the same time that my RSA Research colleagues were uncovering the Boleto fraud in Brazil reported this week, Symantec released a Security Response describing a 2013 cyber-attack on US energy...
View ArticleClik here to view.
Win32/Poweliks - malware that lives in registry value
Some non typical malware which doesn't have any attention from "security experts" and other internet clowns. Maybe because of this it is not well detected on VT.The key features of it, making it non...
View ArticleClik here to view.
Introducing: SSL Blacklist (SSLBL)
In the past year, there was a lot of discussion about Secure Sockets Layer (SSL). More service providers and internet users started using SSL for access to various services. But not only regular...
View ArticleClik here to view.
A new Flying Kitten?
In May 2014 FireEye[1]and Crowdstrike[2] produced reports about the activities of “Flying Kitten”, otherwise known as the Ajax Security Team.In July 2014 NCC Group’s Cyber Defence Operations team...
View ArticleClik here to view.
Disclosure: Insecure Nonce Generation in WPtouch
If you use the popular WPtouch plugin (5m+ downloads) on your WordPress website, you should update it immediately.During a routine audit for our WAF, we discovered a very dangerous vulnerability that...
View ArticleClik here to view.
Shellcode analysis like a semi-PRO
During Nicolas Brulez‘s training at REcon there was a challenge where the goal was to have function names instead of hashes into IDA in order to make shellcode analysis easier. This post describes the...
View ArticleClik here to view.
LibreSSL's PRNG is Unsafe on Linux
The first version of LibreSSL portable, 2.0.0, was released a few days ago (followed soon after by 2.0.1). Despite the 2.0.x version numbers, these are only preview releases and shouldn't be used in...
View ArticleClik here to view.
GCHQ Catalog of Exploit Tools
The latest Snowden story is a catalog of exploit tools from JTRIG (Joint Threat Research Intelligence Group), a unit of the British GCHQ, for both surveillance and propaganda.more...
View ArticleClik here to view.
Havex, Meet OPC Server
Following a post by F-Secure this June, bringing to light a variant of the Havex malware family targetting ICS/SCADA systems, there has been much speculation regarding the motives behind this malware...
View ArticleClik here to view.
Meet ‘Project Zero,’ Google’s Secret Team of Bug-Hunting Hackers
When 17-year-old George Hotz became the world’s first hacker to crack AT&T’s lock on the iPhone in 2007, the companies officially ignored him while scrambling to fix the bugs his work exposed. When...
View ArticleClik here to view.
Paper: Generalized Secret Sharing using Permutation Ordered Binary System
Secret sharing is a method of dividing a secret among n par- ticipants and allows only qualified subset to reconstruct the secret and hence provides better reliability and availability of secret...
View ArticleClik here to view.
Active Directory Vulnerability Disclosure: Weak encryption enables attacker...
Nearly all advanced targeted attacks involve stolen credentials and identity theft. As part of our ongoing research on advanced attacks, we expose a critical Active Directory flaw which enables an...
View ArticleClik here to view.
SkyShare : Evolution Mining Botnet System
At beginning of the year, an advert for a mining botnet appeared on undergroundmore here..................http://malware.dontneedcoffee.com/2014/07/sky-share-evolution-mining-botnet-system.html
View ArticleClik here to view.
Botnet Shylock Legal Notice
Plaintiffs Microsoft Corporation (“Microsoft”) and Financial Services – Information Sharing and Analysis Center, Inc. (“FS-ISAC”) have sued Defendants John Does 1-8 associated with the Internet...
View ArticleClik here to view.
Cross-Platform Exploitation
Binary exploitation might seem like a strange topic for a blog that's historically focused on web-security topics like xss'ing the entire internet or securing embedded content with iframes, but it's...
View Article