Disclaimer: I requested and received an evaluation version of the Apricorn Aegis Padlock. I was sent the 250GB AES-256 version, and I need to return it to the company in 30 days. This is a pretty sweet hard drive, but there are a few annoyances that I think can be improved upon. I was unable to test a few things just due to the time I could devote to this, the fact that I need to return the drive in working condition, and that I don’t have access to some specialized hardware to test timing attacks. The drive is FIPS 197 validated – aka, uses AES according to NIST. You can check out Apricorn’s site for the specs and details,[…]
What’s in a name if it’s transparent? The concept of a “name” has always been an important part of interactivity due to the convenience of association. We use names to keep people and things distinct when we reference them. Beyond that, their significance can be magnified by the value we place on them (e.g. exorcisms, Rumpelstiltskin). It stands to reason that one’s true name, being something of value, would be protected to some extent. We typically accomplish this simply by sharing it selectively, or by using a partial name or a nickname. Our experiences online aren’t much different; pseudonyms have long been part of the fabric of the Internet and are basically e-nicknames. Handles, monikers, and ICQ numbers have all[…]
I just recently bought a new netbook. Now, I know that netbooks are supposedly on the way out, but I love the low price, long battery life, and massive portability. But there’s a problem with netbooks and security. They’re massively portable – whether the person doing the porting is me or a thief. I do my best to keep my netbook safe, but being realistic I’ll admit that it could happen. Now, the biggest loss from someone stealing my netbook is in data; the hardware really isn’t all that expensive. My netbook doesn’t just contain personal information; it’s also full of important business data. I can and do perform regular backups to make sure I don’t lose any of the[…]
Black Hat Briefings have been going on all this week, with the expected announcements of vulnerabilities, tools, and other fun. I refuse to go to Vegas for health reasons, so I often miss out on Black Hat and Defcon. But this week, the one announcement that has me interested is that SMS messages are being used to unlock cars and start them – specifically the Subaru Outback. They also demonstrated that car unlocking isn’t the only capability that SMS messages have. Pretty much anything that uses the GSM network for communication may be vulnerable – electric meters, traffic lights, GPS-tracking, etc. With more and more devices being “always connected”, I suspect we’ll see more problems. And these are the kinds[…]
As some of our readers are well aware, last year many leading browsers finally closed a major privacy hole involving browser history that has been around for more than ten years. Essentially, would-be trackers used JavaScripts to scan links with functions like getComputedStyle() to determine whether each hyperlink was styled as a visited site or unvisited (e.g. visited links are often purple and unvisited are blue). This practice represents a serious threat, since not only can stints of browsing history be logged, but individual users can be tracked and identified with ease (this is one of several ways you can be tracked without cookies). Since this practice of changing styles for visited links has been around since the early days of[…]
If you’re new to the world of testing web application security, you may not be aware of the many great Firefox add-ons available that greatly help such endeavors. While others have compiled similar lists in the past, I thought this week would be a good time for me to share a few of the favorite tools I use in my own web app work. HttpFox: I’ve blogged about this one in the past; it lists for you every HTTP request made during a given browser session, with details on headers, cookies, parameters, responses, and more. Very handy to monitor traffic when you’re browsing around an app. HackBar: Another one I’ve mentioned before, the HackBar is a swiss-army knife that gives[…]