Tag Archives: Security

Malware Free

Posted on 2012-07-20 by jcs

I spent most of the day yesterday going over the entire site looking for malware. I made a local copy of irreal.org and grepped for the signatures that I discussed in my Anatomy of an Exploit post. I didn’t find … Continue reading →

Posted in Administrivia | Tagged | Leave a comment

Anatomy of an Exploit

Posted on 2012-07-19 by jcs

As I wrote yesterday, someone hacked the Irreal WordPress installation causing it to inject JavaScript into pages served by the blog. Here’s a copy of the hacked index.php file: <?php eval(base64_decode(‘JGlwPSRfU0VSVkVS /* elided */ );?> <?php /** * Front to … Continue reading →

Posted in General | Tagged , | 5 Comments

Malware Warnings

Posted on 2012-07-18 by jcs

Yesterday, Google started warning that the Irreal blog was unsafe. After some investigation, I determined that the site had, in fact, been compromised and some JavaScript that targeted Windows users (with the MSIE or Firefox browsers) was being served. I … Continue reading →

Posted in Administrivia | Tagged | Leave a comment

Oh Oh: RSA SecurID 800 Token broken

Posted on 2012-07-03 by jcs

The RSA SecurID 800 token is a small USB device that authenticates users when they sign on to secure computers. It offers two factor authentication and contains encrypted keys and credentials that are, in theory, inaccessible to users or attackers. … Continue reading →

Posted in General | Tagged | Leave a comment

RSA Explained

Posted on 2012-06-20 by jcs

Barry Steyn over at I’m Still Learning has a nice post on RSA and how it works. Steyn explains the needed mathematical background in small pieces that should be accessible to everyone. At each step he works through a small … Continue reading →

Posted in General | Tagged | Leave a comment

Flame Malware Uses New MD5 Collision Attack

Posted on 2012-06-18 by jcs

Much has been written lately about the provenance of the Flame malware. Recent reports suggest that it was a joint project of the United States and Israel. Now comes the startling revelation that Flame used a hitherto unknown MD5 collision … Continue reading →

Posted in General | Tagged | Leave a comment

Hashing Passwords

Posted on 2012-06-15 by jcs

Patrick Nielsen over at Throwing Fire has an excellent post on Storing Passwords Securely that serves as a nice coda to my previous post on Password Advice. One of the problems that I pointed out in that post was the … Continue reading →

Posted in Programming | Tagged | Leave a comment

Living Without Flash

Posted on 2012-06-11 by jcs

Let’s face it: Flash is a mess. Hardly a week goes by without a new exploit and its performance problems are legion. Steve Jobs famously hated Flash and refused to allow its use in iOS. My Linux distribution strongly recommends … Continue reading →

Posted in General | Tagged | 2 Comments

Password Advice

Posted on 2012-06-07 by jcs

There’s been a lot of snark going around the last few days over this password help screen from the Texas Attorney General’s Child Support Services Web Page. Child Support Services are, of course, doing the best they can to preserve … Continue reading →

Posted in General | Tagged | Leave a comment

The TSA (Again)

Posted on 2012-03-26 by jcs

Yesterday I wrote that I don’t often post about the TSA but the latest news is just too good to pass up. Congress is holding hearings on the TSA so naturally they invited Bruce Schneier to testify. That only makes … Continue reading →

Posted in General | Tagged , | Leave a comment