Boing Boing 

Life inside a DDOS "booter site"

The internal records of Lizardsquad's Lizardstresser -- a service that would, for money, flood sites with traffic intended to knock them off the Internet -- were dumped to Mega by Doxbin's former operator, providing an unprecedented public look at the internal workings of booter.

Read the rest

FBI targets companies that hire hackers to protect them against hackers

US businesses are frustrated by the federal government's weak response to hacker attacks. They are hiring cybersecurity firms to launch counterstrikes against foreign-based hackers. Now, that's something the FBI is eager to investigate.

Read the rest

New NSA leaks: does crypto still work?


Matthew Green's got an excellent postmortem on the huge dump of NSA docs Der Spiegel last weekend.

Read the rest

Fingerprints can be reproduced from photos of your hands

A presentation by Starbug at the 31st Chaos Communications Congress (previously) demonstrated a technique for deriving fingerprints from a couple of photographs of your hands. Starbug's proof of concept was a copy of the fingerprints of German Defense Minister Ursula von der Leyen.

Read the rest

Livestreams from the Chaos Communications Congress

The 31st Chaos Communications Congress is underway in Hamburg, where some of the most important, entertaining, mind-blowing, and earth-shaking information about computer security and politics will be revealed. Here's the livestream. (via Hacker News)

Telcos' anti-Net Neutrality argument may let the MPAA destroy DNS


The telcos' ongoing battle against Net Neutrality have led them to make a lot of silly legalistic arguments, but one in particular has opened the whole Internet to grave danger from a legal attack from the entertainment industry, which may finally realize its longstanding goal of subverting DNS to help it censor sites it dislikes, even if it makes life much easier for thieves and spies who use DNS tricks to rob and surveil.

Read the rest

Usbdriveby: horrifying proof-of-concept USB attack

Samy Kamkar has a proof-of-concept attack through which he plugs a small USB stick into an unlocked Mac OS X machine and then quickly and thoroughly compromises the machine, giving him total, stealthy control over the system in seconds, even reprogramming the built-in firewall to blind it to its actions.

Read the rest

Over 700 million people have taken steps to improve privacy since Snowden


As Schneier points out, the way this is spun ("only 39% of people did something because of Snowden") is bullshit: the headline number is that more than 700 million people are in the market for a product that barely exists, and that could make more money than Facebook if you get it right.

Read the rest

Crowdfunding a USB-stick-sized, GNU/Linux-ready computer

A reader writes, "The USB Armory is full-blown computer (800MHz ARM® processor, 512MB RAM) in a tiny form factor (65mm x 19mm x 6mm USB stick) designed from the ground up with information security applications in mind."

Read the rest

Spies can't make cyberspace secure AND vulnerable to their own attacks


In his Sunday Observer column, John Naughton makes an important point that's hammered home by the escape of the NSA/GCHQ Regin cyberweapon into the wild: spies who make war on the Internet can't be trusted with its security.

Read the rest

Innovation in lockpicks: the "hall pass" and the EOD speed-picking set

The Hall Pass is a stainless steel, credit-card-sized pick designed to be slid between the door and the jamb (saving you from cracking your credit cards); the EOD is an extensive speed-pick set that is nevertheless optimized for portability and compactness.

Read the rest

Wall Street phishers show how dangerous good syntax and a good pitch can be


Major Wall Street institutions were cracked wide open by a phishing scam from FIN4, a hacker group that, unlike its competition, can write convincingly and employs some basic smarts about why people open attachments.

Read the rest

Analysis of leaked logs from Syria's censoring national firewall


Syria's brutal Assad government uses censorware from California's Blue Coat System as part of its systematic suppression of dissent and to help it spy on dissidents; 600GB of 2011 logs from Syria's seven SG-9000 internet proxies were leaked by hacktivist group Telecomix and then analyzed by University College London's Emiliano De Cristofaro.

Read the rest

Essential reading: the irreconcilable tension between cybersecurity and national security


Citizenlab's Ron Diebert lays out the terrible contradiction of putting spy agencies -- who rely on vulnerabilities in the networks used by their adversaries -- in change of cybersecurity, which is securing those same networks for their own citizens.

Read the rest

E-cigs and malware: real threat or Yellow Peril 2.0?


After a redditor claimed to have gotten a computer virus from factory-installed malware on an e-cig charger, the Guardian reported out the story and concluded that it's possible.

Read the rest

Router for gamers lets you filter games by distance

The forthcoming Netduma router has a geofilter that lets you restrict the games you join by distance, so you only play against nearby gamers, eliminating a leading cause of lag.

Read the rest

ISPs caught sabotaging their customers' email encryption


Ever since 2013, when the Electronic Frontier Foundation started shaming email providers that did not encrypt their customers' email, more and more mail providers have turned on STARTTLS, which protects email in transit from snooping, without requiring users to take any additional steps.

Read the rest

Cyberwar's hidden victims: NGOs


A new report from the storied Citizen Lab at the University of Toronto documents the advanced, persistent threats levied against civil society groups and NGOs -- threats that rival those facing any government or Fortune 100 company, but whose targets are much less well-equipped to defend themselves.

Read the rest

Indispensable BBC/OU series on cybercrime starts tomorrow

Mike from the Open University sez, "The OU and the BBC have created a new six part series about cybercrime, presented by the technology journalist Ben Hammersley."

Read the rest

Inside Secure threatens security researcher who demonstrated product flaws

Martin Holst Swende maintains a free/open tool for testing software that uses the (notoriously flawed) Iclass Software, which is used by Inside Secure for its RFID-based access systems.

Read the rest

What's the best way to weaken crypto?


Daniel Bernstein, the defendant in the landmark lawsuit that legalized cryptography (over howls of protest from the NSA) engages in a thought-experiment about how the NSA might be secretly undermining crypto through sabotage projects like BULLRUN/EDGEHILL.

Making sure crypto stays insecure [PDF/Daniel J Bernstein]

(via O'Reilly Radar)

FBI chief demands an end to cellphone security

If your phone is designed to be secure against thieves, voyeurs, and hackers, it'll also stop spies and cops. So the FBI has demanded that device makers redesign their products so that they -- and anyone who can impersonate them -- can break into them at will.

Read the rest

How to enable two-step authentication on Google, Facebook, etc.

Gizmodo has a handy guide to enabling two-factor authentication on your accounts with Apple, Google, Microsoft, Twitter, Dropbox, etc.

Two-step, or two-factor authentication protects your accounts by requiring you to provide an additional piece of information after you give your password to get into your account. In the most common implementation, after correctly entering your password, an online service will send you a text message with a unique string of numbers that you'll need to punch in to get access to your account.

The idea is that you're drastically more secure if somebody needs both your password and the physical phone to get access to your accounts. Add a passcode to your phone, and you're safeguarded against someone stealing both.

Is it perfect? No. But it's way better than just irrationally hoping nobody ever gets a hold of your password.

Darkmatter: a secure Paranoid Android version that hides from attackers

Stock Android phones with the Darkmatter OS use encrypted storage, OS-level app controls, and secure messaging by default, but if the phone thinks it's under attack, it dismounts all the encrypted stuff and reboots as a stock Android phone with no obvious hints that its owner has anything hidden on it.

Read the rest

Petition: make it safe to report security flaws in computers


Laws like the Computer Fraud and Abuse Act and the Digital Millennium Copyright Act put security researchers at risk of felony prosecution for telling you about bugs in the computers you put your trust in, turning the computers that know everything about us and watch everything we do into reservoirs of long-lived pathogens that governments, crooks, cops, voyeurs and creeps can attack us with.

Read the rest

Sourcecode for "unpatchable" USB exploit now on Github


Last summer's Black Hat presentation on "Badusb" by Karsten Nohl alerted the world to the possibility that malware could be spread undetectably by exploiting the reprogrammable firmware in USB devices -- now, a second set of researchers have released the code to let anyone try it out for themselves.

Read the rest

Security cruft means every exploit lives forever

Security failures will live on forever, because protocols have no sell-by date. Glenn Fleishman exposes the eternity we face with broken software.

Read the rest

Get 2600's archives from 1987

Emmanuel Goldstein from 2600 Magazine writes, "Volume 4 of The Hacker Digest has been put into PDF format, comprised of issues of 2600 Magazine from 1987."

This was the first year that 2600 adopted the digest format. For the first time ever, a hacker magazine would show up on newsstands and in bookstores around the world. New concepts such as cellular phone fraud and electronic mailboxes for $20 a month were introduced to the public and scrutinized in the pages of 2600, while traditions like the letters section, payphone photos, and 2600 meetings were in their infancy. The hacker spirit from these early issues is remarkably similar to that of today: defiant, curious, and overflowing with data.

VOLUME 4 OF THE HACKER DIGEST RELEASED ALONG WITH DETAILS ON ITS HISTORY

(Thanks, Emmanuel!)

Insecure printer firmware hacked to play Doom

Printer security sucks -- but Michael Jordon's work on hacking the firmware of the standalone Canon Pixma printer is a more playful example of that suckitude than ever seen before.

Read the rest

Bruce Sterling's "The Epic Struggle of the Internet of Things"

It's a new long-form essay in the tradition of Sterling's must-read, groundbreaking 2005 book Shaping Things, a critical perspective on what it means to have a house full of "smart" stuff that answers to giant corporations and the states that exert leverage over them.

Read the rest