Blog of Context Information Security, a UK security consultancy, publishing research on WebGL, timing attacks, SMS, and Electron exploitation.
HN cites it as a source for browser and GPU security research, including the 2013 pixel timing attack whitepaper and WebGL flaws.
> the vuln was not that the JS was bad or untrustworthy, but that the passphrase was sent to the server.
Which is one of the most commonly cited vulnerabilities with web-based crypto. The fact that no JS was involved doesn't really change anything.
> If the entire connection to the server is secure, and the JS is loaded from the secure server and is auditable/checksummed, then the risk is minimal. You either trust the code or you get out.
I assume you're referring to client-side, JS-based encryption. The problem is that the server can always slip a backdoor into the webpage, and your browser will dutifully execute it. It doesn't matter if the JS is sent via SSL. A compromised server can deliver compromised JS, and SSL provides no protection against that.
You can't practically audit for this. You could theoretically read the JavaScript. But performing a thorough audit on a cryptosystem is a big undertaking. And then how do you know it hasn't changed the next time you visit the page? You mentioned checksums, but how are you going to do that? Are you going to manually MD5 the JS file on every visit?
Even if you did, the JS file is just one of many ways a compromised server can backdoor your browser. For example, we recently learned about HTML5 timing attacks (http://www.contextis.com/files/Browser_Timing_Attacks.pdf). And that's just the tip of the iceberg. Checksums aren't going to tell you if these sorts of things are happening.
A compromised server can compromise any…
Context Information Security | Python Developer and Penetration testers | London, UK, Germany, NY, AUS | INTERNS | ONSITE | VISA | https://ctx.is/
Context provides solutions to our clients most complex information security challenges, in order to protect their most critical resources. Our customers trust us with this great responsibility because of the quality of our people; leaders in their field, inquisitive and capable of rising to the most complex of challenges.
Alongside our employees drive and determination to be the best at what they do is Context’s company ethos. We are passionate about developing our staff, through provision of continuous training and development opportunities. We also pride ourselves on our flexible and social working environment.
Context is always looking for smart people to join our company, whether you have formal information security training and experience or not. A passion and a willingness to learn is key: If you are an excellent developer or sysadmin or working in another technical role and have a keen and demonstrable interest in information security, then we would love to hear from you. We are looking for people who can transfer technical skills from other areas into penetration testing and can support you in doing this.
If you're interested but not sure, have a go at our challenges[1][2].
We are also looking for full-time Python/Django developers (including junior roles) to join our in-house development team, to work on exciting…
If you are interested in studying during you own time have a look at the links and suggestions provided on this subreddit.
https://www.reddit.com/r/netsec/comments/g6r71/getting_started_in_network_security_a_list_of/
This has links to many useful resources such as books and many tools that used such as nmap, Nessus, burp suite etc.
Remember if you don’t have permission to attack something it is against the law, which is why there are the following resources that can be used:
Damn Vulnerable Web App (http://www.dvwa.co.uk/)
and
https://www.hackthebox.eu/
Also check out OWASP (The Open Web Application Security Project)
https://www.owasp.org/
There are quite a few universities offering cyber security courses in the UK.
I have listed a few below:
https://www.abertay.ac.uk/schools/school-of-design-and-informatics/division-of-cyber-security/
https://www.ncl.ac.uk/undergraduate/degrees/i190/#courseoverview
https://www.kingston.ac.uk/undergraduate-course/cyber-security-computer-forensics/
https://www.plymouth.ac.uk/courses/undergraduate/bsc-computer-and-information-security
https://www.gre.ac.uk/undergraduate-courses/ach/gf54
There are quite a few companies that have graduate schemes as well.
https://www.nccgroup.trust/uk/about-us/careers/graduates/
https://www.mwrinfosecurity.com/assets/resourceFiles/Recruitment-Brochure.pdf
http://www.aonearlycareers.co.uk/graduates-9 - The application period will open again later this year for Cyber…
Assuming you trust your hosting company (maybe that's another discussion?) I don't think it's possible to leak memory contents VPS-to-VPS but I could be wrong.
In any case, if I had a pile of Bitcoin (unfortunately I do not) I wouldn't put it all in one wallet on one server. From what I've heard, paper wallets are the safest.
That said, maybe "zero out" your wallet before switching VPS providers, changing plans, etc.
This is from 2012 but probably still relevant as we saw with the recent Digital Ocean outrage. http://www.contextis.com/research/blog/dirty-disks-raise-new-questions-about-cloud-securi/
"It is worth noting that the data was not live, in that it was not due to sharing of disk contents between running instances of virtual servers. It is understood that the data is due to disk and swap data not being zeroed after use."
In case of SDR you should not forget to get a license to transmit in GSM spectrum:
Legalities and options
The GSM spectrum is very expensive private property. You may not transmit (or even receive) in GSM bands without permission. In the UK, it is an offence under the Wireless Telegraphy Act to transmit on licensed bands without permission and furthermore intercepting GSM without a warrant is an offence under the Regulation of Investigatory Powers Act.You should apply for a licence (example from OFCOM below) before commencing GSM testing and will also need a faraday cage to suppress radiation. (For these reasons, GSM interfaces get less scrutiny than TCP/IP for example).
https://www.contextis.com/blog/binary-sms-the-old-backdoor-to-your-new-thing
It looks like Flash SMS is handled differently.
Here’s a post from 2020 on the differences within Android to handle flash SMS: https://github.com/moezbhatti/qksms/issues/1536#issuecomment-577678851
Here’s an app, pre-4.3, for sending Flash SMS: https://github.com/romankh/gat-app
There appear to be a couple online services that will let you send Flash SMS (Type 0) but Twilio is not one of them.
Edit: The terminology is confusing! I wrote “type 0” above when in fact it’s a “class 0” sms. Type 0 means a silent SMS, Class 0 means an SMS that’s display-only and not stored. See also https://www.contextis.com/en/blog/binary-sms-the-old-backdoor-to-your-new-thing for a brief overview, though I’m sure there are other, better sources.