Naked Security

The "goto fail" bug isn't a great example; Rust actually does specifically guard against this by requiring curly braces around the body of "if". Here's an explanation of "goto fail", which includes a code snippet. https://nakedsecurity.sophos.com/2014/02/24/anatomy-of-a-goto-fail-app… If C conditionals required explicit braces around the body, the second fail would have been redundant code instead of a security vulnerability. Additonally, Rust will warn you if you have "unreachable" code, such as all the code after the unconditional "goto fail". Though, I'm sure modern C compilers would also warn about this. All that said, Rust definitely does have plenty of bug classes left for people to trip over. Integer under/overflows come to mind (though they're just logic errors instead of undefined behavior).

Not disputing what you say, but mistakes do happen to the best of us. http://sunnyday.mit.edu/accidents/Ariane5accidentreport.html and yet again another OpenSSL bug , another flaw in the open source fallacy of many eyes to spot bugs... https://nakedsecurity.sophos.com/2021/03/28/serious-security-openssl-f… plus when considering in maths there are ways to rearrange formulas including new discoveries like this one (a new way to do quadratic equations) https://news.ycombinator.com/item?id=29342161 https://www.sciencealert.com/math-genius-finally-discovers-easy-way-to… I wonder if discovering a new way to do things could be done to cryptographic algorithms.

It looks super clean to me, the only exception being for the love of all that's good and holy always brace your one-line if statements and loops. You don't want your own "goto fail" do you? ;) [1] I think you did a great job. [1] https://nakedsecurity.sophos.com/2014/02/24/anatomy-of-a-goto-fail-app…

Surprising that schools are requiring additional certs to be added a a device for internet access. This enables "keybridging" mitm attacks on any TLS connection that trusts the cert. Best load a 3rd-party browser and install it locally, rather than compromise the whole device. https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ssl-certific…

Some omissions IMO: never let people SSH in with a password, and for the love of god, stop leaving private SSH keys on servers. Privat SSH keys should never leave your physical proximity. They should be on your laptop, or desktop, or your yubikey, but never on servers. Also SSH agent forwarding is the devil. Don't do it. Lots of really braindead advice in there too, like disabling RDRAND because there might be a backdoor.. come on.. even Linus knows that's obvious bullshit.[1] [1] https://nakedsecurity.sophos.com/2013/09/11/rudest-man-in-linuxdom-ran…

TLS won't cloak your IP address nor your browsing history from the VPN provider... so, even if the content is TLS encrypted, your VPN provider has to that metadata (+ more) across all sites you visit while connected to their servers. which they can then turn over to law enforcement on request[1], or leave on an unsecured S3 bucket (or similar) somewhere[2]. So yeah, in short, we shouldn't be recommending the use of third-party VPNs without qualification. There are valid use cases sometimes, but avoiding tracking is very much not one of them. [1] https://securitygladiators.com/fbi-purevpn/ [2] https://nakedsecurity.sophos.com/2020/07/20/7-vpns-that-leaked-their-l…

> This is an amazing bug. They took AES (seems fine) and an inappropriate but in principle secure cipher mode (CFB8) and then they fixed the IV as all zeroes A bit more detail on what happens next: "So with an all-zero IV and plaintext plus a randomly chosen key, you will end up with an all-zero ciphertext 1 in 256 times on average. [In other words] roughly once in every 256 times the server would randomly concoct a session key for which the correctly-encrypted version of their all-zero ClientChallenge would itself be all zeros."[1] Quoted from a detailed and nicely illustrated article about the bug. [1] https://nakedsecurity.sophos.com/2020/09/17/zerologon-hacking-windows-…

It's worth noting (as mentioned they are under security review) that apparently ClearviewAI lost their client database (hopefully that's all) to hackers last week. Along with being sued by the big boys, that's gotta hurt. https://nakedsecurity.sophos.com/2020/02/28/clearview-ai-loses-entire-…

Changing credentials is helpful if you assume they're compromised every once in a while. These days if a unique and random password is used for each service and/or with 2fa enabled, that assumption is not that great anymore. Adding to that the fact that most people will just add "1" or the current year at the end, it makes updating the password much less useful - it will only stop completely trivial malware. The recommendation has actually changed in high level policies relatively recently: https://nakedsecurity.sophos.com/2016/08/18/nists-new-password-rules-w…

I searched but couldn't find anything suggesting they're ad-blocking by default -- what they do have, eg https://nakedsecurity.sophos.com/2019/01/30/firefox-makes-ad-tracker-d… is ability to block trackers. But it's only default enabled in "private" mode. Could you backup your statement? Mozilla got a huge sum of money from Google last time I checked (a few months ago), so it would be amazing if they were allowed by Google to enable ad-blocking as a default (unless there was whitelisting that included Google).

They were not hosting any CP. That is not proven. As it stands, this is a simple service takedown. Actually, this is speculation added by the sensationalist https://nakedsecurity.sophos.com website, the original source doesn't even mention it. I mean, they even believe this is a zero day attack, I can't simply trust the quality of any information there. Edit: they updated the link, here's the old link - https://nakedsecurity.sophos.com/2018/11/21/hacker-erases-6500-sites-f…

VXHeaven was a great site. Didn't know it was offline. Any idea what happened? Edit: Apparently raided by police. https://nakedsecurity.sophos.com/2012/03/28/vx-heavens-virus-writing-w…

https://blog.talosintelligence.com/2018/05/VPNFilter.html provides a detailed technical overview of how VPNFilter functions and their findings conclude it appears to be a derivative of similar efforts by the same group. NCCIC released the following analysis last year with more on the topic: https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_E… Sophos published an article a month ago that warned about this exact scenario: https://nakedsecurity.sophos.com/2018/04/18/russias-grizzly-steppe-gun…

> you can't preload the whole internet "You wouldn't HSTS the whole internet, would you?" Google: "Hold my beer..." https://nakedsecurity.sophos.com/2017/10/03/google-is-making-encryptio… Right now it's mostly unimportant new domains, but it's a start, and they could convince other domain registrars to follow-suit.

It's weird, and even harmful in many cases. A modern goto of sorts: it has performance benefits [1], but not overall readability ones. switch (x) { case 0: doThing1(); break; case 1: doThing2(); break; default doThing3(); } vs if (x == 0) { doThing1(); } else if (x == 1) { doThing2(); } else { doThing3(); } This somewhat unsafe form of switch-case made it into C, Java, C#, and JavaScript, and cases the great iOS SSL bug of 2014. [2] [1] https://en.wikipedia.org/wiki/Duff%27s_device [2] https://nakedsecurity.sophos.com/2014/02/24/anatomy-of-a-goto-fail-app…

Sophos (security software) https://nakedsecurity.sophos.com/ Not pushing their products. Sensible advice and news coverage.

What makes you say that? They've requested extradition in all the other similar cases I'm aware of. Most recently: https://nakedsecurity.sophos.com/2015/07/17/lauri-love-rearrested-face…

Note that this is not an official statement, this is something that an agent at a conference: https://nakedsecurity.sophos.com/2015/10/28/did-the-fbi-really-say-pay… has the official statement: The FBI doesn't make recommendations to companies; instead, the Bureau explains what the options are for businesses that are affected and how it's up to individual companies to decide for themselves the best way to proceed. That is, either revert to back up systems, contact a security professional, or pay.

> Do not unnecessarily use braces where a single statement will do. if (condition) action(); > and if (condition) do_this(); else do_that(); The Apple SSL bug (https://nakedsecurity.sophos.com/2014/02/24/anatomy-of-a-goto-fail-app… makes me wonder if this is really worth the potential for introducing bugs.

I've been trying to learn the best practices on password "storage" and verification lately. I thought this was a really good step-by-step technical breakdown of the right way to hash passwords (I have no opinion/knowledge of the hashing algorithms in the article, but I've found a lot of other positive mentions of PBKDF2, bcrypt, and scrypt) http://nakedsecurity.sophos.com/2013/11/20/serious-security-how-to-sto…

> As for "being targeted by government" that's called conspiracy theories. This is already happening and not a conspiracy theory any more: [0] http://nakedsecurity.sophos.com/2012/06/08/interest-in-cryptocat-spike… [1] http://www.cnet.com/news/researcher-detained-at-u-s-border-questioned-…

No, they couldn't occur in "any programming language". In fact there aren't other memory unsafe languages in wide use than C/C++. And it's not a "potentially" thing, as is apparent to anyone following news about browser vulnerabilities. For a recent public performance, see pwn2own - http://nakedsecurity.sophos.com/2014/03/14/pwn2own-day-two-chrome-and-…

http://nakedsecurity.sophos.com/2012/11/19/facebook-https-t-shirt/ Worth pointing out that Facebook only had opt in https as of 2011 and default https came a long time after that.

A great example of this is bit-squatting, where you register a domain name that matches a popular one except for one flipped bit: http://nakedsecurity.sophos.com/2011/08/10/bh-2011-bit-squatting-dns-h… It's enough to get quite a few visitors who were aiming for the popular site.

http://nakedsecurity.sophos.com/2011/08/10/bh-2011-bit-squatting-dns-h… Great article on "how bit-flipping in memory chips or CPU caches can also cause you to visit a wrong domain that may be one character off from the real one." I think I remember seeing it on HN awhile back.

Link in the article comments to http://nakedsecurity.sophos.com/2011/09/21/microsoft-dumps-partner-tel… is worth reading. Amazing that someone would have the balls to try this, but I suppose there are no penalties for what amounts to abuse of privileges. I know MS tightened up on some aspects of the partner scheme (presumably to stop everyone and his dog using it as a way to get free copies of Windows). So, who owns Comantra? There needs to be an international register of people unfit to own companies, or whose companies one shouldn't do business with. In the UK, Companies House records the really bad guys who've managed to get struck off as directors, but this kind of scam needs to get you on a little list too.

Interesting that this arrest follows just a week after a series of other arrests in USA/UK/NL regarding LulzSec and Anonymous: http://nakedsecurity.sophos.com/2011/07/20/arrests-lulzsec-anonymous-h… Not a good time to be a hacktivist

Do you mean lulzsec or this 'thehackernews' site? This site conveys no new information and has a very _very_ annoying design (a twitter bird that follows you around? really?), and the only thing OP (unixroot) does on hn is post link to this site. In this case, all the link contains is a one-line blurb of Sophos' article at [http://nakedsecurity.sophos.com/2011/06/12/26000-sex-website-usernames…

I'm a little confused with your response, or we appear to be talking past each other. For context, I'm a former pentester (NCC Group, formerly Matasano). I've been an ML researcher for four years now, so it's possible I have a unique perspective on this; the combination of pentester + ML is probably rare enough that few others have it. > You cannot inject a valid-looking system message from user text. https://greshake.github.io/ did exactly that. (HN discussion: https://news.ycombinator.com/item?id=34976886) Take a look at this screenshot: https://greshake.github.io/resources/demo.png Now, I understand it's possible that Bing was using an older version of your ChatML format, or that they did something dumb like inserting website data into their system prompt. But you need to anticipate that users will do dumb things, and I strongly recommend that you prepare them with some basic security recommendations. If the Bing team can screw it up, what chance does the average company have? I suspect what happened is that they insert website data into the system text, to give Bing context about websites. But that means that the attack wasn't coming from user text -- it was coming from system text. I.e. the system text itself tricked system to talk like a pirate. This is known as a double-escaping problem in the pentesting world, and it pops up quite a lot. In this case, an attacker was able to break out of the sandbox by inserting user-supplied text (website data) into an…

It is possible to create customised UNIX-like OS with custom kernels, read-only filesystems (mounted images) and writable directories mounted as tmpfs, booting from removable USB. Some call this "diskless". There are some drawbacks from using USB media such as lack of a good randomness source on boot but there are many advantages. Kernels and filesystems are just single files on the USB media and can be easily switched/updated. The system stays "clean". It is "like new" on every reboot. I was doing this with a netbook long before the so-called "Chromebook" came along.^1 The problem with Chromebooks is that they are designed to try to get people to "log in" to Google and to use "the [Google] cloud" for storage. Chromebooks in Guest Mode have an array of Google-authored daemons running the the background from read-only media. There is no way to disable them. You cannot even change the options passed to Chrome, e.g., to disable "Origin Trials". This setup is great if you love everything Google, but not great if you just like computers, you bought the computer for the hardware and drivers, and prefer to choose your own software. With these Google programs always running in the background, it means you do not have ultimate control over the computer, Google does. Another annoying thing is that ChromeOS, as well as Chrome, is a WIP. It is constantly changing. For example, bluetooth may be working fine and then suddenly there is an "automatic update" that breaks it. …