2 years, 2 months ago
These promises should be kept if they are made at first in final part of the opus about safety of UEFI, and then are repeated from ZeroNights 2015 scene therefore today we will talk about how to force UEFI SecureBoot to work not for the benefit of Microsoft as it is most often configured by default, and for the benefit us. If it is interesting to you how to generate the obstvenny keys for SecureBoot how to set them instead of standard (or together with them), how to sign your favourite EFI loader how to prohibit loading unsigned or signed with others conversion keys as the interface for the SecureBoot setup at AMI, Insyde and Phoenix looks and why it, by and large, is not important at all — welcome under kat, but be afraid of a large number of pictures and long console instructions.
2 years, 2 months ago
Everything began when I customized a security system of one CRM. As it often happens, in it there were users with the different permission access levels to a specification (we will call them entities). They had an identical type of the main grid, customizability of access to entities was necessary. At first I thought of ACL, but …
I want to leave a number of comments. Their main sense that it is not similar to terrible tabs. This code reminds me some test prototype, but not the ready application more. So perhaps not everything is as terrible as the author in article presents. First, the code contains an error and random numbers are used always. In reality by it hardly took place in process system testing. And secondly, there is such concept as "certification of programs". And the given code fragment — the first candidate for detection.
Data leakage of users of different services because of cracking of the last — not a rarity, unfortunately. It is worth remembering sensational cracking of service of changes of Ashley Medison when in the Network data of millions of users flowed away. A huge number of users were just bots, but it changes nothing — each of us is vulnerable.
In the Network even data of users who monitor the accounts flow away, think out difficult passwords, try to provide negative scenarios. But leaks all the same happen. And interesting nuance — if about data security of adults all monitor and everywhere, then a problem of data protection of children in the Network somehow not too very famous. And here it is even more problems, children are not too well acquainted with bases of information security. And if yes, that hackers find other ways of data acquisition of kids. It is possible to give recent cracking of the VTech services (the vendor of children's electronic toys) as a result of which in the Network data of millions of accounts of little users flowed away as an example.
2 years, 2 months ago
The independent security expert Wesley Weinberg (Wesley Wineberg) underwent serious pressure from the Facebook company. She did not pay for the found vulnerabilities on the Instagram server moreover threatens with a legal claim.
Wesley found vulnerability in infrastructure of Instagram by means of which downloaded practically all valuable that is on the Instagram servers: the source code of the latest version, SSL certificates and private keys for Instagram.com, keys for the signature of kuk of authentication, accounting data from the e-mail server and keys for some other products, including for the signature of mobile applications under iOS and Android.
Researchers of safety Hector Marko (Hector Marco) and Ismael Ripoll (Ismael Ripoll) published information on the vulnerability in the popular Grub2 loader found by them 0-day which is used in the majority Linux-systems. Operation of vulnerability allows to get access to the abnormal Grub2 console in circumvention of the password. It, in turn, opens for the malefactor an opportunity carrying out the attack directed to increase of privileges in systems and access to all information.
Long-term experience of teaching in the Information security direction (further IB) allows to state positive tendencies in this area:
Owners of business, at last, began to consider risks as so significant IB as financial and operational, and even more often look for not only the entrusted, but qualified advisers at a position of the CSO level (Chief Security Officer)
Normative approach to creation of systems of protection allowed IB to become in large quantities the consumed service
Explosive growth of risks of IB supports steadily great demand and the sentence in the market of services of training in the corresponding direction
In time it is available also negative:
It is also difficult to confirm the qualification in IB today, in particular if successful experience is got in the CIS countries, and the potential employer is in USA \Europe
Mass character leads to IB konsyyumerization problem
Quality of services of training and skill level of specialists falls
As a result there is whole staff of divisions of providing IB from which on all hierarchy levels, since a security administrator and graduating from the head, thoughtlessly fulfill requirements of standards of safety, without thinking of the proof of security of an automated system after their execution.
This article shows possibilities of evidential approach for creation of the protected automated systems and has educational character.
For certain many of you repeatedly faced myths about / dev/urandom and / dev/random. Perhaps, you even trust in some of them. In this post we will break covers from all these myths and we will sort the presents strong and weaknesses of these random number generators.
Thanks to sensational scandal between the Target and Ashley Madison companies, cases when we become witnesses of how cooperation with third-party service providers can do harm to the "elastic" environment — where devices became frequent, services and applications regularly work in the intensive mode, thereby, giving to hackers an opportunity to get into networks of the enterprises. Here five of widespread threats of work-related "foreign" suppliers:
2 years, 2 months ago
This post how normal cracking turned back pangs of conscience and sincere torments. There will be not many source codes, it is more than photos and analysis. So, somebody Vasya works as "the bad guy". Extent of falling of Vasya such is that funds for life to it are brought by search and analysis of information, access to which was compromised owing to illiterate service, disorder or economy on service personnel.