Warcarting
One of the techniques used by the MIT students in their MBTA report was the impressive Warcart.
They must be off their (shopping) trolley!
The Musings of Chris Samuel
The Thoughts and Feelings of a Melbourne Person
Archive for Security
A Tale of Two Transport Hacks
In the USA a court has ordered that three MIT students not talk at DEFCON about their security assessment of the Massachusetts Bay Transit Authority (MBTA) fare cards. Apparently the court believes that “discussing the flaws at a public conference constituted a ‘transmission’ of a computer program that could harm the fare collection system“, [...]
Are you sure you want to take a laptop to the USA ? (Updated)
From the Washington Post:
Federal agents may take a traveler’s laptop or other electronic device to an off-site location for an unspecified period of time without any suspicion of wrongdoing, as part of border search policies the Department of Homeland Security recently disclosed. Also, officials may share copies of the laptop’s contents with other agencies and [...]
Applying Graphics Cards to Password Cracking
On the Beowulf list there has been a long thread on GPGPU and especially nVidia’s CUDA language. As part of it Prentice Bisbal posted about a friend of his, Mario Juric, who decided to write a proof of concept MD5 password hashing program to take advantage of CUDA.
In his message to the Beowulf list [...]
Exploiting Network Cards
Now this is a scary (and pretty cool) potential abuse of network card firmware and PCI bus architecture to bypass firewalls described by Arrigo Triulzi (quoted on Ben Laurie’s blog):
3) from 1 & 2 above, after about two years, I’ve reached my goal of writing a totally transparent firewall bypass engine for those firewalls which [...]
Response to PayPal on EV Certificates
Over on the PayPal blog Michael Barrett (their chief security officer) mentions a paper he and Dan Levy wrote extolling the virtues of Extended Validation certificates.
I’ve left a comment there (yet to escape from moderation) questioning the merits of EV and I thought I’d reproduce it here, especially in light of the recent cross-site scripting [...]
Re: Glen Turner: Key generation
In his blog Glen writes on the Debian OpenSSL stuffup:
Hopefully this fiasco will re-energise hardware manufacturers into providing hardware-based randomn number generation. The current scavenging across the operating system for any source of entropy isn’t acceptable and is one of the root causes of this current flaw.
But this wouldn’t have helped in this situation as [...]
Debian OpenSSL stuffup - SSH keys and SSL certs not random enough (updated)
Update: Debian has a good summary page on their wiki.
This is pretty serious - a packaging stuff-up for OpenSSL by Debian (and hence Ubuntu) has resulted in not-very-random randomness being used in various packages such as OpenSSH for key generation. The Ubuntu report says:
A weakness has been discovered in the random number generator used by [...]
Quote of the day
By Bruce Schneier:
You know you’ve got a problem when you can’t tell a hostile attack by another nation from bored kids with an axe to grind.
Also, on a crypto related humour note - The Traveling Cryptographer’s Problem, via Bart.
Microsoft demonstrates why DRM is a Bad Idea ™
From Techdirt:
Playsforsure was so bad that Microsoft didn’t even use it for its own Zune digital media device. Along with that, Microsoft shut down its failed online music store, and now for the kicker, it’s telling anyone who was suckered into buying that DRM’d content that it’s about to nuke the DRM approval servers that [...]
Recent Posts
- Google Chrome
- Next Debian release name announced
- New theme - Atahualpa
- Microsoft goes back on IE8 standards promise for Intranet sites
- OOXML more complicated than the CERN Large Hadron Collider
