Random musings
A good friend of mine called me with this question: You work in computer security, right? I want to login to this website called xyz.com. Can anyone intercept my communications? I ask: 1) Are you using https://xyz.com, and not http? He replies: Yes I ask: 2) Are you logging in from a browsing center using … Read more
CVE-2023-48795 describes a prefix truncation attack on the SSH (Secure Shell) protocol. The vulnerability is called Terrapin. Why Terrapin? Terrapin is a small North American turtle (shell, get it?). Reminds me of my Alma Mater, the University of Maryland, College Park. The college football team is called Maryland Terrapins, as diamondback terrapins are endemic to … Read more
Security is only as good as the weakest link. Example: You have installed a very strong lock on your front door. A potential intruder will look at the strong lock and go to the back of the house and find a weaker lock to pick. Also, one should be able to quantify what a "very … Read more
Rolling your own crypto is a bad idea — we should leave this to experts though even they get it wrong quite frequently. In general, one can safely use standard crypto algorithms and ciphers provided you follow the requirements carefully. Many require cryptographically strong random numbers — if this property is not satisfied, attackers can … Read more
Web Assembly is a low level portable binary format (bytecode) for a stack-based virtual machine is a W3C web standard, that runs in a sandbox, on all major browsers runs nearly as fast as native machine code, and enables high performance applications on the Web language, hardware and platform independent (unlike Java applets and Flash) … Read more
Cryptographers and Security Researchers have a penchant for coming up with colorful acronyms and names which describe, in brief, the vulnerability or exposure. Some are them are BEAST, CRIME, ShellShock, SLOTH, POODLE, Lucky 13, Sweet32, Smurf, Petya, BlackNurse, FREAK, DROWN, BREACH, LOGJAM, HeartBleed, CloudBleed, TicketBleed, Fireball, CLOAK and DAGGER, WANNACRY, SambaCry, HIDDEN COBRA, BroadPwn, Blueborne, … Read more
One of the most important properties of a cryptographic hash function is that of “Strong collision-resistance“, that is, it should be "computationally infeasible" to find distinct inputs x1, x2 such that hash(x1) = hash(x2). For the SHA-1 hash function, which generates a 160 bit hash, to have strong collision resistance, only a brute force attack … Read more
If you love functional programming and want to write native cross-platform mobile apps (Android, iOS and even Windows Phone) and you know F#, you are set. The company that made this happen was Xamarin. For more info on Xamarin, read my blog article titled Monkey business — write once, deploy on iOS, Android and Windows … Read more
Snow3G is one of the two algorithms (the other being AES) algorithms used in LTE (4G) mobile network. The specifications for LTE come from the standards body called 3GPP and include the specification and reference implementation in C for the Snow 3G algorithm. There is an algorithm for confidentiality (encryption/decryption), and an algorithm for integrity. … Read more
I am a happy customer of Ola. I decided to try Uber. I installed the Uber app on my wife’s Android mobile and tried to register with her email address and got the message "Email address already in use". I don’t recall registering with Uber and thought that my wife had done so. However, a … Read more