dguido

51 ms·

451.
by dguido 15y ago
The actual research can be found here: http://www.trailofbits.com/research/#mobile-eip
452.
Accountability - Not Code Quality - Makes iOS Safer Than Android(threatpost.com)
3 points by dguido 15y ago|1 comments
453.
by dguido 15y ago
Hey, I'm the author of the above research. AMA. Also, there's a good discussion going on in the comments of this Threatpost article about my research: https://threatpost.com/en_us/blogs/accountability-not-code-q...
454.
by dguido 15y ago
Mark Dowd found this bug and described it in The Art of Software Security Assessment (TAOSSA) in 2006. lawl. https://twitter.com/#!/mdowd/status/192986878138523648 Here's the actual page: http://i.imgur.com/vPjOR.jpg
455.
by dguido 15y ago
FYI here's the new draft that tptacek mentioned: http://www.fiercegovernmentit.com/story/cispa-sponsors-narro...
456.
by dguido 15y ago
I'm not sure I have a problem with companies under attack sharing IDS logs. This whole EFF post seems like a stretch. I think "threat information" is pretty clearly not my mom's personal e-mail, unless my mom is some kind of Tibetan support
457.
by dguido 15y ago
Actually, history does not show that low-end mass malware moves to more advanced techniques and you CAN predict the vulns they'll target in advance, as long as you're familiar with their motivations, capabilities, and incentives. http://ww
458.
by dguido 15y ago
Why does Apple need to fix security bugs in Webkit? Are they being exploited somewhere by attackers I'm not familiar with? It doesn't seem like there is a problem to solve. I'd venture to say that Apple is more proactive than most other ven
459.
by dguido 15y ago
... they have. They don't ship OS X with Java anymore. The only exploit this attack campaign is using is a Java exploit. They install Java when the user attempts to run something that needs it. The next best thing they'll have to do is, whe
460.
by dguido 15y ago
This article is a little bit sensationalist. Here is analysis of the actual text of the law: http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-t... http://blog.c22.cc/2012/03/29/eu-legislation-digging-below-t...
461.
by dguido 15y ago
It looks nice? I don't get it.
462.
by dguido 15y ago
FWIW my local coffee shop uses ShopKeep and Perka and they work great! http://www.shopkeep.com/ipad-pos http://itunes.apple.com/us/app/perka/id428620381?mt=8
463.
by dguido 15y ago
Actually, I have evidence to the contrary. Check this out: PrivacyParrot: See if a site sells your personal information. http://www.privacyparrot.com/ It uses AI and NLP to parse privacy policies into easily readable statements: http://w
464.
by dguido 15y ago
Yeah, I understand that Yoga means something different to you, but what it means to you isn't at all what we're talking about. It's kind of like the word "hacking", which to the mass market refers to the activity of taping two batteries tog
465.
by dguido 15y ago
Do they still ship with an out-of-date version of AppArmor? I'm pretty sure the vanilla linux kernel is stuck at version 2.3.1. It looks like Ubuntu ships with version 2.7 now: http://wiki.apparmor.net/index.php/AppArmor_versions
466.
by dguido 15y ago
Playing devil's advocate: As the title says, the vendor included backdoors in the application. I'm not sure I can trust them and their clearly irresponsible development practices to patiently wait for them to handle this on their own.
467.
GPG4Browsers is a prototype implementation of the OpenPGP as a Chrome Extension(gpg4browsers.recurity.com)
4 points by dguido 15y ago|0 comments
468.
by dguido 15y ago
The fact that certain people think they're entitled to privacy while broadcasting an access point name over a shared wireless frequency is a joke.
469.
by dguido 15y ago
New York City, Seattle, and San Francisco - iSEC Partners - Application Security Consultants iSEC Partners is currently looking for Security Researchers and security-focused software developers to fill openings in its application security c
470.
by dguido 15y ago
Excuse my ignorance, but doesn't this just mean that Linux users would have to go into the BIOS and switch off the Secure Boot setting? And isn't Secure Boot solving a real security problem? Besides, if you're running a computer powerful en
471.
by dguido 15y ago
I think it's kind of a standard disclaimer. Notice they got the most important part right: independent review by experts. Even people that do security well need to engage in security theater.
472.
by dguido 15y ago
Isn't this exactly what BlackBerry did in the early 2000s? Mobile phones sucked, so they processed as much as they could on the server and sent it down compressed and easily parseable to the client?
473.
by dguido 15y ago
Pretty sure these guys have been doing something similar for a while now: https://www.lifeensured.com/ I wonder if PassMyWill has ever been audited for security vulnerabilities? LifeEnsured has: https://www.lifeensured.com/faqs#security
474.
by dguido 15y ago
This is called DLL Hijacking and it's a class of flaws that gained prominence on Windows earlier this year. Although I would say that Mandiant discussed the issue first, it was only after HDM practically described the WebDAV and other remot
475.
by dguido 15y ago
We (iSEC Partners) have a whitepaper on the topic that explains most of the basics. http://www.isecpartners.com/storage/white-papers/web-session...
476.
by dguido 15y ago
Contrast this with TradeHill which recently announced a two-factor login option powered by DUO Security. I'll take a guess and say that tptacek at least knows who runs DUO :-). https://www.tradehill.com/ http://www.duosecurity.com/about
477.
by dguido 15y ago
Relevant: http://rdist.root.org/2010/11/29/final-post-on-javascript-cr... The killer for me has always been #7 on Nate Lawson's list: Auditability. How do you tell that your browser is using the right copy of the code to do the crypto?
478.
by dguido 15y ago
Not exactly, but these two are slightly related: Hacking Exposed: Web Applications, 3rd Edition - approaches the subject from a wider angle, not just about appsec. http://www.amazon.com/HACKING-EXPOSED-WEB-APPLICATIONS-3rd/d... Hacking: T
479.
by dguido 15y ago
Lots of malware actually uses this to communicate with infected hosts now-a-days. You see it a lot in the backdoors used for more targeted attacks. AFAIK, going wayyy back, this strategy was first talked about by Sophsec at an infosec confe
480.
by dguido 15y ago
"About a month ago I was chatting on skype to a colleague about a payload for one of our clients,” he wrote. “Completely by accident, my payload executed in my colleagues skype client." If I had to guess, they were probably pasting back and

More ›