Errata Security

To "catch a serial killer" you'd need each retailer selling printers to track the ID and model number on a receipt, to be submitted to a central government agency and saved in a database. This is not what's happening in your country either, am I correct? Instead this ordeal makes it possible for the government agencies, who do keep track of their own inventory to follow the tracks of those, who decided to leak documents to the outside world by printing them on printers at work. Like the outing of the whistleblower, courtesy of a journalist at The Intercept. https://blog.erratasec.com/2017/06/how-intercept-outed-reality-winner.…

Since this is literally "Hacker News", I think it's worth focusing a technical hacking-nugget near the center of this political thing: Allegedly Assange agreed to crack password-hashes for Manning, supplying the resulting fresh passwords to Manning to use. [0] While I'm sure the US government is out to make an example of Assange, I don't see how anyone can argue the above allegation falls under regular ethical journalism. Just imagine a newspaper editor saying: "Wow, these documents you found while burgling the mansion are awesome, hey, how about I give you a fresh set of lockpicks and you go back and see what was behind the other doors?" [0] https://blog.erratasec.com/2019/04/assange-indicted-for-breaking-passw…

Thanks for the explanation. I can half-agree, but think the meta-discussion about the role of Twitter and Facebook in shaping the US politics is worthy of discussion even if the NY Post article turns out to be a wholesale fabrication. You might be interested that I also posted this article [https://blog.erratasec.com/2020/10/yes-we-can-validate-leaked-emails.h… which talks about the relative ease of validating the emails using GMail's DKIM header. Unlike this one (where I think the first two pages of comments are actually pretty good), that one got very few votes and no discussion.

This blog post touches on the topic (highly recommended read): https://blog.erratasec.com/2020/07/how-ceos-think.html > Outside consultants often end up saying the same thing you do, but are trusted whereas you are not. CEOs listen to the outsiders because they have no hidden political agenda.

I've written a lot of TCP deep-packet inspection code, including parsing FTP control protocol. So I was surprised by this post by Robert Graham: https://blog.erratasec.com/2019/08/hacker-jeopardy-wrong-answers-only.… - FTP control protocol follows the specification for Telnet.

It's pretty amazing that there are over 900k accessible vulnerable endpoints sitting there waiting to be attacked. This is why they're freaking out about it. Source: https://blog.erratasec.com/2019/05/almost-one-million-vulnerable-to.ht… Eventually someone will wormify that vuln in a few weeks or months and it's going to be a big mess when it happens.

This is an excellent essay, and touches on a lot of the key ideas both of what C is and of how C maps to the hardware. In particular, I completely agree with where Steve lands here, which is that C can give you more understanding of how computers work but won't necessarily reveal some "deep ultimate truth" about the zen of computers. Especially in light of this essay recently shared on HN (https://blog.erratasec.com/2015/03/x86-is-high-level-language.html), which makes the excellent point that even a language that is compiling down to raw x86 assembly is still operating in a "virtual machine" relative to what goes on in the actual chip and the flow of electrons through the silicon-metal substrate. It's abstractions all the way down.

I agree with the statement that NAT provides no privacy benefits, but there are security benefits to NAT. As Robert Graham says, "NAT is a firewall. It's the most common firewall. It's the best firewall." https://blog.erratasec.com/2017/01/nat-is-firewall.html

This article describes how to turn off the led light on Windows, which is surprisingly easy: http://blog.erratasec.com/2013/12/how-to-disable-webcam-light-on-windo… TLDR: Webcams follow the UVC standard and, according to this standard, the LED indicator light is controlled by the host software. So a simple hack is to find the webcam driver DLL, find the function that controls the LED (such as TurnOnOffLED()), make it return immediately, done.

The post linked to in the OP is an excellent explainer for those who aren't familiar with the process of signing a message using a Bitcoin address' private key: http://blog.erratasec.com/2016/05/satoshi-how-craig-wrights-deception.…

Assorted pointers: http://danluu.com/clwb-pcommit/ on the speed of modern persistent storage and the need to get the OS out of the way for best performance http://blog.erratasec.com/2013/02/custom-stack-it-goes-to-11.html on the speed of modern networking and the need to get the OS out of the way for best performance http://joeduffyblog.com/2015/12/19/safe-native-code/ and the rest of that blog on Microsoft Research's Midori research OS, based on C# and type safety rather than traditional process-based (i.e. Memory Mapping Unit-based) security https://sel4.systems/ for a proven-secure (with many asterisks) native-code microkernel MirageOS (OCaml) and similar (often Rust-based) unikernels ... and of course, the rise of the heavyweight microkernel under the name "hypervisor" Each of these ideas has very serious downsides, but each also has earnest proponents.

This, please don't engage in personal attacks on HN, but much, much more importantly, please don't be a partisan fascist. Trump supporters are not your enemy and they are not subhumans incapable of reason. They disagree with you about who we should elect and the direction our country should take, but their voices matter. There is no substantive difference between thinking Trump supporters are mentally deficient and thinking the same of $race or $gender or $nationality. Really believing in this value is more important to our democracy than who wins the presidency. Edit: in short, we can all learn something from Linus Torvalds. http://blog.erratasec.com/2015/11/we-should-all-follow-linuss-example.…

Branding the company as the coolest out there is arguably just as important as the technology itself. While it' not technically that difficult to create that demonstration, it's still fantastically fun to watch. Musk and Tesla continue to nail it on the Cool Factor. It's very much in line with Apple's branding strategy - http://blog.erratasec.com/2015/12/tesla-is-copying-apples-business-mod…

I hear you, I just think it is going to take a generation to fix. If you follow the infosec folks on twitter you might see what I see, a lot of juvenile behavior. Some of the key debates lately have been about Hugging and this lovely drama. http://blog.erratasec.com/2015/09/whats-that-drama.html#.VhPo72PTVKQ

This is an interesting perspective on just "how much of a crime" that was: http://blog.erratasec.com/2015/06/some-notes-about-ulbricht-verdict.ht… I haven't followed this too closely, and maybe he is guilty of attempting to murder people and such, but it does look like the government/judge wanted to punish him with a life sentence mostly for the the fact that he created a "drug market outside the reach of the law" (or whatever).

Unfortunately the best response to this is extracting the private key for the cert it installs in the root and publishing it: http://blog.erratasec.com/2015/02/extracting-superfish-certificate.htm…

Well, technically it wasn't hacking or unauthorized computer access since the CIA originally set up the secure network: http://blog.erratasec.com/2014/07/no-cia-didnt-spy-on-other-computers.… Nonetheless this is a complete moral failure and power-abuse that is equally worthy of punishment. They were monitoring use of the network, then attempting to classify new information as it was being analyzed.

Instead of the somewhat fuzzy method of dating via news, couldn't they combine this approach with that recommended by Errata Security to use bitcoin as a public ledger? http://erratasec.blogspot.com/2013/05/bitcoin-is-public-ledger.html

Of course it is reputable. Its on blogspot, a free web host known for exclusivity and high standards. Blogspot is well known for some of the highest quality software(1) and adult paradigm-shifting(2) link sites on the planet. Blogspot, along with Errata Security(3), provides only the highest of high quality security(4) information. After all, the tagline is "Errata Security is a high-end cyber security consulting company." (1) NSFW: http://iphonevolt.blogspot.com (2) NSFW: http://fascormet.blogspot.com/ (3) http://erratasec.blogspot.com/ (4) NSFW: http://tophackdownloads.blogspot.com/

Sorry, but no. Compensation is highly relevant. Do you work for free? Or do you just not consider security research to be worth anything? Although there are various opinions on the best way to disclose bugs, your view of what it means to be "whitehat/legitimate" is not actually consistent with the infosec industry, so please do not misuse the terms to throw judgments at others. We can easily spin it the other way too after all - one could say that the largest, most profitable company in the world has a moral obligation to compensate those that are protecting their users where they failed to. For reference: http://www.digitalbond.com/about-us/vulnerability-disclosure-policy/ http://erratasec.blogspot.com/2011/09/finally-responsible-disclosure-p… http://www.securityfocus.com/brief/933 http://trailofbits.com/2009/03/22/no-more-free-bugs/

Robert Graham had a rebuttal, too, and he mentions how Let's Encrypt for instance is quite vulnerable to sophisticated attackers employing DNS spoofing attacks against it: https://blog.erratasec.com/2018/04/no-ray-ozzie-hasnt-solved-crypto.ht… Also, I think most would agree that CAs are quite terrible at security. It's part of the reason why everyone thinks the CA system sucks and is not trustworthy and it's also why Google has been pushing for Certificate Transparency to be able to verify if the CAs (or people hacking the CAs) are misbehaving. But it's still a patch on a broken system. And look what's been happening with Symantec, too, the largest CA. They were terrible at managing the infrastructure in a secure manner. There are thousands of different CAs. Most are probably insecure or hacked, we just haven't learned about it yet. Also, if you read Green's post, he mentions how this wouldn't be like the CA/software signing system at all. In those systems, you can revoke the certificate. If someone gets the master key for 500 million iPhones, those phones will either need to be bricked or they will remain vulnerable forever. If the NSA/FBI would learn that the system was compromised, they'd never tell us about it either, because they'd know people would then be pushing for the removal of the system, and they wouldn't want that after fighting for so long for something like it. I think Ozzie is being very irresponsible pushing for this. And the reason he is being this…

> i.e. How did Snowden get on an Aerofloat flight out of HK almost a week after the manhunt started? Because Hong Kong let him go, as he wasn't officially wanted at the time: > as the US had revoked his passport (and issued an arrest warrant) and notified Hong Kong of the revocation a day before the plane took off. However, as numerous news reports of the time reported, the US information [in the arrest warrant] was contradictory and incomplete, and thus Hong Kong did nothing to stop Snowden from leaving [0]. The Guardian [1] quotes a Hong Kong official as saying Snowden left "through a lawful and normal channel". The rest of that blog post is worth a read: http://blog.erratasec.com/2016/12/your-absurd-story-doesnt-make-me.htm… [0] https://web.archive.org/web/20130822210647/http://www.thestandard.com.… [1] https://www.theguardian.com/world/2013/jun/23/edward-snowden-arrives-m…

The idea is that the DSL compiler would be responsible for ensuring constant-timeness. Note that C, C++, and Rust offer no guarantee of constant-timeness. Even processors don't offer constant-timeness guarantees and some instructions (often division) are not constant-time. See also http://blog.erratasec.com/2015/03/x86-is-high-level-language.html. I wrote the paper mostly in the context of implementing signature verification, which doesn't require side-channel protection since there are no secrets in verification. But, I think the DSL approach is even more important for ECDH and signing, where side-channel protection is important. Finally, given that processors don't even promise us that any instruction is constant-time, and given that other types of attacks are possible where constant-timesness doesn't help so much (e.g. power analysis), I think it is worth considering other approaches to side-channel protection (e.g. blinding). For many applications, constant-timeness isn't sufficient and I'd love to learn that it isn't necessary.

You may enjoy the RISC deprogrammer: https://blog.erratasec.com/2022/10/the-risc-deprogrammer.html

https://krebsonsecurity.com/2019/05/microsoft-patches-wormable-flaw-in… Looks like I misread and this requires RDP to be enabled, which is not the default. But it was pretty common, Rob Graham counted almost one million hosts. https://blog.erratasec.com/2019/05/almost-one-million-vulnerable-to.ht…

> Not that Lenovo is a bad company persay The argument can certainly be made though. At least regarding their consumer laptop decision circa 2015 when, in addition to the quality issues, they were shipping the Superfish ad-ware which was installing a notably insecure self-signed root certificate to deliberately Man-in-the-Middle HTTPS connections so it could inject display ads. See: - https://marcrogers.org/2015/02/19/lenovo-installs-adware-on-customer-l… - https://blog.erratasec.com/2015/02/extracting-superfish-certificate.ht…

https://blog.erratasec.com/2013/02/multi-core-scaling-its-not-multi.ht… Maybe you should just take a college computer architecture course along the lines of Hennessy/Patterson. This is nothing new, I learned much of this in college 15 years ago. The problem has only gotten worse since then, computers have not become more single threaded.

Almost certainly. Though are ways to account for that fact after they are printed: https://blog.erratasec.com/2017/06/how-intercept-outed-reality-winner.…

There are 128k+ emails, many about the Biden's business dealings. I say 'possible evidence' because it hasn't been investigated yet. https://bidenlaptopemails.com/ We also know that the emails, or at least many of them, are valid. The signatures, made years before the leaks, check out. https://blog.erratasec.com/2020/10/yes-we-can-validate-leaked-emails.h…

It's very... problematic. And Yasha clearly displays a lack of knowledge (or is knowingly lying) by making the claim that the Tor Project is tipping of the US government to vulnerabilities. Here is why: https://blog.erratasec.com/2018/03/askrob-does-tor-let-government-peek… Some more Yasha stuff: https://micahflee.com/2014/12/fact-checking-pandos-smears-against-tor/