Tag Archives: leak

以色列黑了 Kaspersky 的系統,然後通報美國機密資料外洩...

前幾天在「俄羅斯政府透過卡巴斯基的漏洞,偷取美國國安局的文件」這邊提到了俄羅斯是透過 Kaspersky 的漏洞取得,後續又有些消息揭露出來了... 這件事情會被抓包,是因為以色列黑進去 Kaspersky 的系統 (???),然後發現美國的機密資料外洩 (??????),於是通報盟友美國後追查出來的 (?????????):「Israel hacked Kaspersky, then tipped the NSA that its tools had been breached」。 這過程是殺小 XDDD

Posted in Computer, Murmuring, Network, Political, Security, Software|Tagged , , , , , , , |Leave a comment

Yahoo! 的資料外洩數量超過之前公佈的十億筆,上升到三十億筆

Oath (Y! 的新東家,Verizon 持股) 發表了新的通報,外洩數量直接上升到 3 billion 了:「Yahoo provides notice to additional users affected by previously disclosed 2013 data theft」。 也就是當時所有的使用者都受到影響: Subsequent to Yahoo's acquisition by Verizon, and during integration, the company recently obtained new intelligence and now believes, following … Continue reading

Posted in Computer, Murmuring, Network, Privacy, Security|Tagged , , , , , , , , , , |Leave a comment

Apache 的 Optionsbleed

Apache 也出了類似 Heartbleed 的包:「Apache bug leaks contents of server memory for all to see—Patch now」,原文出自「Optionsbleed - HTTP OPTIONS method can leak Apache's server memory」。 這掛上 CVE-2017-9798 了,影響版本包括了: This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. 發生在對 … Continue reading

Posted in Computer, Murmuring, Network, Privacy, Security, Service, Software, WWW|Tagged , , , , , , , , , , |Leave a comment

超過三億筆的密碼 (Hash 過的)

Troy Hunt 放出三億筆 SHA1 hash 過的密碼讓大家研究:「Introducing 306 Million Freely Downloadable Pwned Passwords」。 他引用了 NIST 新的草案中對密碼的建議,阻擋已知外洩的密碼: 檔案可以在「I been pwned? Pwned Passwords」這邊下載。

Posted in Computer, Murmuring, Network, Privacy, Security, Service, Social|Tagged , , , , , , , , , , |Leave a comment

最近 OpenVPN 的安全性漏洞...

看到「The OpenVPN post-audit bug bonanza」這個只有苦笑啊... 作者在 OpenVPN 經過一連串的安全加強後 (包括 harden 計畫與兩個外部單位的程式碼稽核找到不少問題),決定出手挖看看: After a hardening of the OpenVPN code (as commissioned by the Dutch intelligence service AIVD) and two recent audits 1 2, I thought it was now time for some … Continue reading

Posted in Computer, Murmuring, Network, Security, Software, VPN|Tagged , , , , , , , , , , , , , , |Leave a comment

利用 Side-channel 資訊判斷被 HTTPS 保護的 Netflix 影片資訊

在「Netflix found to leak information on HTTPS-protected videos」這篇看到了研究員透過 VBR 所透露出的 side channel 資訊,成功的取得了被 HTTPS 保護的 Netflix 影片資訊。這對於美國的 ISP 是個大利多 (加上之前通過的法案),但對於個人隱私則是嚴重的打擊。 這項研究的準確率非常高: To support our analysis, we created a fingerprint database comprised of 42,027 Netflix videos. Given this collection of fingerprints, … Continue reading

Posted in Computer, Movie, Murmuring, Network, Recreation, Security, Television|Tagged , , , , , , , , , , , , , , , |Leave a comment

Cloudbleed:Cloudflare 這次的安全問題

Cloudflare 把完整的時間軸與影響範圍都列出來了:「Incident report on memory leak caused by Cloudflare parser bug」。 出自於 2/18 時 Google 的 Tavis Ormandy 直接在 Twitter 上找 Cloudflare 的人: Could someone from cloudflare security urgently contact me. — Tavis Ormandy (@taviso) February 18, 2017 Google 的 … Continue reading

Posted in CDN, Cloud, Computer, Murmuring, Network, Search Engine, Security, WWW|Tagged , , , , , , , , , , , , , , , , |Leave a comment

Yahoo! 這次應該是史上最大的一次 leak...

Yahoo! 這次爆出來的 leak 應該是目前史上最大的一次:「An Important Message About Yahoo User Security」。 目前 Yahoo! 的研判是 2014 年時由政府單位搬出去的: A recent investigation by Yahoo has confirmed that a copy of certain user account information was stolen from the company’s network in late 2014 by … Continue reading

Posted in Computer, Murmuring, Network, Security, WWW|Tagged , , , |Leave a comment

Dropbox 儲存密碼的方式

記得 Dropbox 前陣子才強迫所有使用者重設密碼:「The Dropbox hack is real」,官方的報告在這:「Resetting passwords to keep your files safe」,當時洩漏出來的資訊可以知道 2012 年的時候 Dropbox 用的是 SHA1: What we've got here is two files with email address and bcrypt hashes then another two with email addresses and SHA1 hashes. … Continue reading

Posted in Cloud, Computer, Murmuring, Network, Programming, Security|Tagged , , , , , , , , , , , , |Leave a comment

OpenSSH client 的重大安全性更新

CVE-2016-0777 與 CVE-2016-0778 安全性漏洞是關於 OpenSSH client 的部分:(USN-2869-1: OpenSSH vulnerabilities) It was discovered that the OpenSSH client experimental support for resuming connections contained multiple security issues. A malicious server could use this issue to leak client memory to the server, including … Continue reading

Posted in Computer, Murmuring, Network, Security, Software|Tagged , , , , , , , |1 Comment