Beware rogue 2FA apps in App Store and Google Play
https://nakedsecurity.sophos.com/2023/02/27/beware-rogue-2fa-apps-in-app-store-and-google-play-dont-get-hacked/, posted 28 Feb by peter in mobile scam security
We analysed several authenticator apps after Twitter had stopped the SMS method for 2FA. We saw many scam apps looking almost the same. They all trick users to take out a yearly subscription for $40/year. We caught four that have near identical binaries. We also caught one app that sends every scanned QR code to the developer’s Google analytics account.
Krislådan – Var förberedd om krisen kommer | Röda Korset
https://www.rodakorset.se/vad-vi-gor/kris-och-katastrof/krisberedskap/krisladan/, posted 2 Feb by peter in diy drink energy food inswedish list security
Är du förberedd om krisen kommer? Så här packar du en krislåda med grejer för att klara dig i upp till en vecka - till exempel om du drabbas av ett långvarigt strömavbrott.
https://www.zaproxy.org/, posted Jul '22 by peter in development free opensource security software toread
The world’s most widely used web app scanner. Free and open source. Actively maintained by a dedicated international team of volunteers.
Seriously, stop using RSA
https://blog.trailofbits.com/2019/07/08/fuck-rsa/, posted Feb '22 by peter in communication opinion security
RSA is an intrinsically fragile cryptosystem containing countless foot-guns which the average software engineer cannot be expected to avoid. Weak parameters can be difficult, if not impossible, to check, and its poor performance compels developers to take risky shortcuts. Even worse, padding oracle attacks remain rampant 20 years after they were discovered. While it may be theoretically possible to implement RSA correctly, decades of devastating attacks have proven that such a feat may be unachievable in practice.
espoofer: An email spoofing testing tool that aims to bypass SPF/DKIM/DMARC
https://github.com/chenjj/espoofer, posted Jan '22 by peter in communication email free security testing
espoofer is an open-source testing tool to bypass SPF, DKIM, and DMARC authentication in email systems. It helps mail server administrators and penetration testers to check whether the target email server and client are vulnerable to email spoofing attacks or can be abused to send spoofing emails.
Using Let's Encrypt for internal servers
https://blog.heckel.io/2018/08/05/issuing-lets-encrypt-certificates-for-65000-internal-servers/, posted Dec '21 by peter in development howto networking security toread
But while there are many tools to automatically renew certificates for publicly available webservers (certbot, simp_le, I wrote about how to do that 3 years back), it's hard to find any useful information about how to issue certificates for internal non Internet facing servers and/or devices with Let's Encrypt.
The Cryptopals Crypto Challenges
https://cryptopals.com/, posted 2021 by peter in development learning security toread
This is a different way to learn about crypto than taking a class or reading a book. We give you problems to solve. They're derived from weaknesses in real-world systems and modern cryptographic constructions. We give you enough info to learn about the underlying crypto concepts yourself. When you're finished, you'll not only have learned a good deal about how cryptosystems are built, but you'll also understand how they're attacked.
Visual guide to SSH tunnels
https://robotmoon.com/ssh-tunnels/, posted 2021 by peter in communication howto networking reference security
This page explains use cases and examples of SSH tunnels while visually presenting the traffic flows.
GitHub - FiloSottile/mkcert: A simple zero-config tool to make locally trusted development certificates
https://github.com/FiloSottile/mkcert, posted 2020 by peter in automation development networking security
mkcert is a simple tool for making locally-trusted development certificates. It requires no configuration.
Hostnames and usernames to reserve - Geoffrey Thomas (geofft)
https://ldpreload.com/blog/names-to-reserve, posted 2020 by peter in development howto list reference security webdesign
If you're setting up a service where people can register their own usernames to be used as a hostname (
username.example.com), email address (
email@example.com), or URL path (
example.com/username) within your domain, there are some common names you should avoid letting the general public register.
This is a list of all the names I know that should be restricted from registration in automated systems. If you know of others, please let me know and I'll update this page.