The Privacy BlogPrivacy, Security, Cryptography, and Anonymity

Feb/15

13

Snipers at the Watering Hole

Play

Rhino at watering hole

Security researchers discovered a very sophisticated watering hole attack against Forbes.

There is a major trend towards increasingly targeted cyber attacks, from advanced persistent threats (APT), to spear phishing. Now we are seeing targeting applied to watering hole attacks. I think of this as the sniper at the watering hole. (more…)

· · · · · · ·

Feb/15

1

China requiring back doors in banking software

Asian woman at computer

“HONG KONG — The Chinese government has adopted new regulations requiring companies that sell computer equipment to Chinese banks to turn over secret source code, submit to invasive audits and build so-called back doors into hardware and software, according to a copy of the rules obtained by foreign technology companies that do billions of dollars’ worth of business in China.”

New Rules in China Upset Western Tech Companies – NYTimes.com

Previous blog posts on China censorship:

China celebrates 25th anniversary of Tiananmen with censorship. – The Privacy Blog The Privacy Blog

China launches MITM attack on GitHub – The Privacy Blog The Privacy Blog

Lance Cottrell is the Founder and Chief Scientist of Anonymizer. Follow me on Facebook, Twitter, and Google+.

· ·

Asian woman headsmack

FBI Director James Cormey says that the North Korean’s who hacked Sony were tracked because of bad operational security in their use of proxies.

We saw the same thing with the take down of the Silk Road website. Few people have the skills, tools, and discipline to be 100% consistent with their anonymity. Any slip at any time can blow your cover. Of course, this could have been an intentional false flag, the rabbit hole can get very deep. Jeff Carr makes the case that this is actually quite likely.

(more…)

· · · ·

3 birds on a wire

Google engineer Adrienne Felt recently noticed that Gogo in-flight Wi-Fi was messing with the SSL certificates on secure Google web pages.

Her browser showed a problem with the HTTPs connection, and further investigation showed that the SSL certificate was self signed by Gogo’s own untrusted certificate authority. (more…)

· · · · ·

Play

Rotten onion

Right after the Lizard Squad finished with a DDOS attack on the PSN and XBOX networks, they launched an attack against the Tor anonymity system. The attack was simple, set up enough Tor relays to be able to identify a significant fraction of Tor users and connect them with their activity. They got caught because they were bozos (perhaps intentionally). They did the attack hard and fast, which made it easy to identify the rogue relays, and they bragged about it (which told people to look for the attack). (more…)

· · · · · ·

<< Latest posts

Older posts >>