Tag Archives: leak

超過三億筆的密碼 (Hash 過的)

Troy Hunt 放出三億筆 SHA1 hash 過的密碼讓大家研究:「Introducing 306 Million Freely Downloadable Pwned Passwords」。 他引用了 NIST 新的草案中對密碼的建議,阻擋已知外洩的密碼: 檔案可以在「I been pwned? Pwned Passwords」這邊下載。

Posted in Computer, Murmuring, Network, Privacy, Security, Service, Social | Tagged , , , , , , , , , , | Leave a comment

最近 OpenVPN 的安全性漏洞...

看到「The OpenVPN post-audit bug bonanza」這個只有苦笑啊... 作者在 OpenVPN 經過一連串的安全加強後 (包括 harden 計畫與兩個外部單位的程式碼稽核找到不少問題),決定出手挖看看: After a hardening of the OpenVPN code (as commissioned by the Dutch intelligence service AIVD) and two recent audits 1 2, I thought it was now time for some … Continue reading

Posted in Computer, Murmuring, Network, Security, Software, VPN | Tagged , , , , , , , , , , , , , , | Leave a comment

利用 Side-channel 資訊判斷被 HTTPS 保護的 Netflix 影片資訊

在「Netflix found to leak information on HTTPS-protected videos」這篇看到了研究員透過 VBR 所透露出的 side channel 資訊,成功的取得了被 HTTPS 保護的 Netflix 影片資訊。這對於美國的 ISP 是個大利多 (加上之前通過的法案),但對於個人隱私則是嚴重的打擊。 這項研究的準確率非常高: To support our analysis, we created a fingerprint database comprised of 42,027 Netflix videos. Given this collection of fingerprints, … Continue reading

Posted in Computer, Movie, Murmuring, Network, Recreation, Security, Television | Tagged , , , , , , , , , , , , , , , | Leave a comment

Cloudbleed:Cloudflare 這次的安全問題

Cloudflare 把完整的時間軸與影響範圍都列出來了:「Incident report on memory leak caused by Cloudflare parser bug」。 出自於 2/18 時 Google 的 Tavis Ormandy 直接在 Twitter 上找 Cloudflare 的人: Could someone from cloudflare security urgently contact me. — Tavis Ormandy (@taviso) February 18, 2017 Google 的 … Continue reading

Posted in CDN, Cloud, Computer, Murmuring, Network, Search Engine, Security, WWW | Tagged , , , , , , , , , , , , , , , , | Leave a comment

Yahoo! 這次應該是史上最大的一次 leak...

Yahoo! 這次爆出來的 leak 應該是目前史上最大的一次:「An Important Message About Yahoo User Security」。 目前 Yahoo! 的研判是 2014 年時由政府單位搬出去的: A recent investigation by Yahoo has confirmed that a copy of certain user account information was stolen from the company’s network in late 2014 by … Continue reading

Posted in Computer, Murmuring, Network, Security, WWW | Tagged , , , | Leave a comment

Dropbox 儲存密碼的方式

記得 Dropbox 前陣子才強迫所有使用者重設密碼:「The Dropbox hack is real」,官方的報告在這:「Resetting passwords to keep your files safe」,當時洩漏出來的資訊可以知道 2012 年的時候 Dropbox 用的是 SHA1: What we've got here is two files with email address and bcrypt hashes then another two with email addresses and SHA1 hashes. … Continue reading

Posted in Cloud, Computer, Murmuring, Network, Programming, Security | Tagged , , , , , , , , , , , , | Leave a comment

OpenSSH client 的重大安全性更新

CVE-2016-0777 與 CVE-2016-0778 安全性漏洞是關於 OpenSSH client 的部分:(USN-2869-1: OpenSSH vulnerabilities) It was discovered that the OpenSSH client experimental support for resuming connections contained multiple security issues. A malicious server could use this issue to leak client memory to the server, including … Continue reading

Posted in Computer, Murmuring, Network, Security, Software | Tagged , , , , , , , | 1 Comment

人總是有很多感嘆的...

超越國界,同一種故事總是會在不同地方看到:

Posted in Cloud, Computer, Murmuring, Network, Security | Tagged , , , | 3 Comments

Ashley Madison 資料分析...

把 Ashley Madison 洩漏出來的資料拿來分析發現網站上根本沒有女性在使用:「Almost None of the Women in the Ashley Madison Database Ever Used the Site」。 作者分析以後發現 550 萬的女性使用者幾乎都是假的: It isn’t even a sadscape of 31 million men competing to attract those 5.5 million women in the database. Instead, … Continue reading

Posted in Computer, Murmuring, Network, Security | Tagged , , , | Leave a comment

這次的 Ashley-Madison 資料外洩

在「Notes on the Ashley-Madison dump」這邊給了這次婚外情約會網站 Ashley Madison 資料外洩的註解,甚至還包括 BitTorrent 的 magnet:// 下載連結... 將近四千萬筆資料的資料外洩 (實際約三千六百萬),男性為大宗,約 28 million 是男性,5 million 女性 (依據 gender 欄位),有 2 million 無法確認。不過如果交叉比對信用卡資料,會發現只有男性付費: It's heavily men. I count 28-million men to 5 million woman, according to the "gender" … Continue reading

Posted in Computer, Murmuring, Network, P2P, Security, WWW | Tagged , , , , , , , | Leave a comment