Everything you need to know about the Shellshock Bash bug

Remember Heartbleed? If you believe the hype today, Shellshock is in that league and with an equally awesome name albeit bereft of a cool logo (someone in the marketing department of these vulns needs to get on that). But in all seriousness, it does have the potential to be a biggie and as I did with Heartbleed, I wanted to put together something definitive both for me to get to grips with the situation and for others to dissect the hype from the true underlying risk. ...

November 14, 2014 · 1 min · 91 palabras · Nacho Cano

Everything you need to know about the Heartbleed SSL bug

Every now and then in the world of security, something rather serious and broad-reaching happens and we all run around like headless chicken wondering what on earth it means. Did the NSA finally ”get us”? Is SSL dead? Is the sky falling? Well it’s bad, but not for everyone and quite possibly not as bad as many are saying it is. » Troy Hunt | troyhunt.com

November 14, 2014 · 1 min · 66 palabras · Nacho Cano

POODLE attacks on SSLv3

My colleague, Bodo M¶ller, in collaboration with Thai Duong and Krzysztof Kotowicz (also Googlers), just posted details about a padding oracle attack against CBC-mode ciphers in SSLv3. This attack, called POODLE, is similar to the BEAST attack and also allows a network attacker to extract the plaintext of targeted parts of an SSL connection, usually cookie data. Unlike the BEAST attack, it doesn’t require such extensive control of the format of the plaintext and thus is more practical. Fundamentally, the design flaw in SSL/TLS that allows this is the same as with Lucky13 and Vaudenay’s two attacks: SSL got encryption and authentication the wrong way around – it authenticates before encrypting. ...

November 14, 2014 · 1 min · 116 palabras · Nacho Cano

Traducción de la Nota G

La Máquina Analítica no tiene ninguna pretensión de producir nada. Puede hacer cualquier cosa que sepamos cómo ordenarle que haga. Puede seguir un análisis; pero no tiene la capacidad de anticipar ninguna relación o verdad analíticas. Su función es ayudarnos a hacer accesible aquello con lo que ya estamos familiarizados. Está diseñada para hacer esto principalmente, claro está, por medio de sus facultades ejecutivas; pero es probable que ejerza de otra manera una influencia indirecta y recíproca sobre la propia ciencia. Porque, al distribuir y combinar las verdades y las fórmulas del análisis, de manera que las combinaciones mecánicas de la máquina las puedan manejar con mayor rapidez y facilidad, las relaciones y la naturaleza de muchas cuestiones de la ciencia quedarán bañadas en otra luz y podrán investigarse en mayor profundidad. Sin duda, esto es una consecuencia indirecta y, en parte, especulativa, de tal invento. Sin embargo, es evidente que, en general, al concebir una nueva forma de registrar verdades matemáticas y arrojarlas para su uso, es probable que nos inspiren nuevas perspectivas que, de nuevo, deben reaccionar en la fase más teórica del asunto. Todas las ampliaciones del poder humano, o aumentos del conocimiento humano, conllevan siempre varias influencias colaterales, aparte de los objetivos principal y secundario obtenidos. ...

November 14, 2014 · 2 min · 216 palabras · Nacho Cano

How To Become A Hacker

There is a community, a shared culture, of expert programmers and networking wizards that traces its history back through decades to the first time-sharing minicomputers and the earliest ARPAnet experiments. The members of this culture originated the term ’hacker’. Hackers built the Internet. Hackers made the Unix operating system what it is today. Hackers make the World Wide Web work. If you are part of this culture, if you have contributed to it and other people in it know who you are and call you a hacker, you’re a hacker. ...

November 8, 2014 · 1 min · 96 palabras · Nacho Cano

Secure messaging scorecard

In the face of widespread Internet surveillance, we need a secure and practical means of talking to each other from our phones and computers. Many companies offer ”secure messaging” products”but are these systems actually secure? We decided to find out, in the first phase of a new EFF Campaign for Secure & Usable Crypto. » eff.org

November 7, 2014 · 1 min · 56 palabras · Nacho Cano

Cómo ’hackear’ un ordenador con la radio del móvil

El sistema truca las ondas electromagnéticas del monitor. De esta forma se puede transmitir información desde la pantalla a un teléfono que esté a menos de siete metros, con un ancho de banda de hasta 60 bytes por segundo, suficientes para obtener una contraseña en ocho segundos, según aseguran los investigadores. » Sergio Ferrer | elconfidencial.com

November 4, 2014 · 1 min · 56 palabras · Nacho Cano

Early Digital Research CP/M Source Code

Computer Scientist Gary Kildall created just such an operating system in 1974 for a small computer called the ”Intellec-8ó that Intel had designed to showcase their new microprocessors. Called ”CP/M”, it was unlike most other operating systems for small computers because it was written in PL/M, a portable higher-level language that he had designed earlier, rather than in the assembly-language of a particular computer. That meant that CP/M could be ported to run on many different personal computers. And if the applications were written in PL/M, they could be ported as well. ...

November 3, 2014 · 1 min · 97 palabras · Nacho Cano

What Every App Developer Should Know About Android

The goal for this research was to identify the most common problems and challenges that Android developers face with the devices they build for. The 288 unique Android device models represent a significant volume of Android use: approximately 92 to 97% of global Android volumes, depending on how it gets measured and what regions and markets are included. This research represents remarkable coverage of Android usage globally, and it shows the most obvious problems as well as the status of Android hardware and software from a developer’s point of view. ...

November 2, 2014 · 1 min · 95 palabras · Nacho Cano

Hackers Are Using Gmail Drafts to Update Their Malware and Steal Data

Researchers at the security startup Shape Security say they’ve found a strain of malware on a client’s network that uses that new, furtive form of ”command and control””the communications channel that connects hackers to their malicious software”allowing them to send the programs updates and instructions and retrieve stolen data. Because the commands are hidden in unassuming Gmail drafts that are never even sent, the hidden communications channel is particularly difficult to detect. ...

October 29, 2014 · 1 min · 77 palabras · Nacho Cano