A secure version of user.js to harden Firefox installations

Sunday, December 21st, 2014

Warning: Backup your existing user.js file (if it exists) and use with caution.  Some website functionality may break. Some of the settings in this user.js file might seem redundant, as some of them are already set to the same values by default. However, the user.js file has this nice property, that ...

Strengthening 2-Step Verification with Security Key

Tuesday, October 21st, 2014

2-Step Verification offers a strong extra layer of protection for Google Accounts. Once enabled, you’re asked for a verification code from your phone in addition to your password, to prove that it’s really you signing in from an unfamiliar device. Hackers usually work from afar, so this second factor makes ...

This POODLE bites: exploiting the SSL 3.0 fallback

Tuesday, October 14th, 2014

Today we are publishing details of a vulnerability in the design of SSL version 3.0. This vulnerability allows the plaintext of secure connections to be calculated by a network attacker. I discovered this issue in collaboration with Thai Duong and Krzysztof Kotowicz (also Googlers). SSL 3.0 is nearly 15 years old, ...

WPA2 wireless security cracked

Friday, March 21st, 2014

There are various ways to protect a wireless network. Some are generally considered to be more secure than others. Some, such as WEP (Wired Equivalent Privacy), were broken several years ago and are not recommended as a way to keep intruders away from private networks. Now, a new study published ...

New DDoS malware targets Linux and Windows systems

Wednesday, December 18th, 2013

Attackers are compromising Linux and Windows systems to install a new malware program designed for launching distributed denial-of-service (DDoS) attacks, according to researchers from the Polish Computer Emergency Response Team (CERT Polska). The malware was found by the Polish CERT at the beginning of December and the Linux version is being ...