There is a hard coded SSH password, 'FGTAbc11*xy+Qqz27', in Fortigate devices < v5.0.7. You can use this script to access any device before that version.
The initial announcement of the partnership between WhatsApp and TextSecure ( https://whispersystems.org/blog/whatsapp/ ) states that it was only for the Android WhatsApp client, and I'm unable to find an update saying that it has been added to the iOS client.
Offensive security is not just breaking into computers. In the information security industry, it means demonstrating flaws in security in a way that will help your client/employer/whoever defend against these techniques better in the future.
Thanks for the link! I will definitely have to listen to this later. Black Hat Python and Grey Hat Python are great cookbooks and references for learning offensive Python skills, and I've used both books quite a bit to help others learn Python for security.
SQLmap has been part of many hackers' toolkits for quite some time now. It's very well known in the security industry as you suspected, and many of us penetration testers use it quite a bit for automating web app testing. I do imagine that it could be very useful for web devs, to test their security, and I wish more of them used it regularly!
Most users would have a smartphone or other device with 1Password or their password manager of choice on it, so you can copy the password manually from that device. I tend not to log in on any device that isn't mine, though.
Fuzzing is useful for finding bugs that may or may not be serious security issues. If a program crashes when you feed it invalid input, it could potentially crash in a way that allows code execution.
After finding a crash, a researcher will generally explore this to see if it allows for arbitrary code execution. If it does, it is possible for someone to create a weaponized exploit.
For a utility as widely-used as ffmpeg, any bugs pose a threat to many systems. Fuzzing it makes the Linux ecosystem safer for all of us (hopefully).
Unfortunately, I can't recommend a System76 laptop. I use the Galago UltraPro as a work laptop, and it is not an enjoyable experience at all. The construction is flimsy, and the keyboard is _terrible_. I have never used a worse keyboard on a laptop. I wanted to love it, but I can't recommend it at all.
One of the major reasons my current organization uses Hipchat is that it supports XMPP. The importance to us is that it allows us to use OTR between users with clients like Pidgin or Adium. As a security company, that is a very valuable thing.
I don't accept this premise. Even if you ban swimming pools, that doesn't prevent children from drowning while swimming in the ocean, or lakes, or rivers, or even backyard swimming pools. All of those environments are just as much (or more) of a risk, and far more difficult to adequately cover even with the most well-trained lifeguards. Should we prevent children from learning to swim, or enjoying the water, even in a relatively controlled environment?
I'm an infosec guy, and I use a 13" retina MacBook Pro. Unfortunately my work laptop is different, but for outside of work (security is my hobby as well as my work), the MacBook does exactly what I need. Long battery life, great build quality, and the screen is amazing for reading a lot.
I'm not a fan of Apple, but when I was looking through my options while shopping for a new laptop recently, there was nothing else that seemed like it wasn't a compromise for the same price.
According to the numbers in the post, it shouldn't be anywhere near as bad, just due to the smaller number of vulnerable servers. 269/530000 servers scanned isn't anything to panic about, unless the problem is larger than it appears from this research.
That's a good point. I was thinking about it from the perspective of Earth-launched debris, which would usually be traveling somewhat the same direction, as it's the cheapest orbit in terms of energy expenditure.
On the other hand, in order to maintain the orbit, that space junk is going to be traveling at close to the same speed, if it's at the right altitude to hit you.
That's a pretty silly thing to demand. There are very few things that most people find enjoyable which are "optimally good". Requiring something to be "optimally good" in order to do it would make a quite dull life for most of us.
I meant that more in the general sense, many of the probes that we have in space have been there for decades. You're right that it is very impressive to have gone so far in so little time!
This is so damn cool. It's humbling to realize the scale of the universe we exist in, and how small a part of it we really are. And we're flinging probes around the solar system, millions of miles away, to learn more about our universe.
These are machines that still work, decades after they're launched on top of the most powerful (and most violent) form of transportation we've created, and after they travel millions of miles through the extremes that space provides. It's awe inspiring that we can accomplish things like that, and it's incredibly disappointing that more people don't realize the scale of what is being accomplished.
Using a salt ensures that an attacker cannot use pre-generated rainbow tables to crack something. If there is no salt, it is very fast to use rainbow table lookups for cracking.
The salt doesn't really need to be secret, as it is only there to make an attacker work harder. However, the existence of a known, hardcoded salt means that an attacker can generate rainbow tables specifically for cracking these cookies, so the salt isn't really useful here.
I've heard of KakaoTalk before; it's one of the most popular messaging applications in South Korea. According to Wikipedia it's used by 93% of smartphone owners in South Korea [1]. Daum Kakao is the parent company, and looks to have their fingers in a lot of generic web services pies.
The way password crackers work now, it is quite easy to crack passwords that are combinations of words, even with alphanumeric substitution. The best passwords are completely random, and 24+ characters.
I switched to using Spacemacs from vim a couple months ago. I find it's a huge boost to my productivity; letting me use vim modes/hotkeys that I'm used to, and adding the handy features that emacs and plugins can provide.
I hope I'm parsing this statement incorrectly, but it seems as though you're rolling your own solution to authentication and encryption, rather than using TLS. According to your organization's website, you're an IoT platform. That's terrifying, honestly. I hope I'm misinterpreting something.
More well-known to whom? Most non-technical people I know have never heard of Linus Torvalds, or Linux. Kevin Mitnick is a name that has been in the media in much more prominent positions. As far as the "hacking" vs "cracking" debate, that fight has been lost for many years.
With the number of attacks against SSLv3 and/or RC4, I think it's a good idea. Especially given that it's a government website. With a target that large, it's a safe bet that, at any given moment, someone is trying something against that site. And really, who's going to access cio.gov from an XP box? Heh.