Category: InfoSec

  • Disclosure: e-MDs, Inc. Solution Series 7.2.1.634 Screen Lock Failure Information Disclosure

    e-MDs, Inc. Solution Series integrated electronic health record and practice management software version 7.2.1.634 contains a flaw in the screen lock functionality. When a user locks the screen, under some circumstances, the screen will display the login box but fail to obscure any of the information displayed otherwise. As I discovered on March 21, 2014…

  • BSidesLV, Charity, and a change of heart.

    Read it all heathen! Teaser list of stuff in the charity box is included below. As most reading this blog know, next week is the annual pilgrimage to Las Vegas to attend the ‘meta-con’. A mix of BSidesLV, BlackHat Briefings USA, DEFCON, and a number of other smaller sub-conferences, meet-ups, gatherings, and the ever present…

  • Disclosure: Samsung Galaxy Phones Factory Reset Persistent Local Information Disclosure

    A couple years back, I handed my Samsung Galaxy S1 down to a friend. When she got it she browsed the file system out of curiosity and noticed that it had retained private information; both from applications, as well as content I generated (e.g. pictures). While she promised to do a write-up of all the…

  • Why I Love and Hate Presenting at Security Cons

    Hate I am not really a public speaker. I am nervous when I speak, even on topics I am very familiar with. Part of that is because I hold myself to a high standard for accuracy and ‘no bullshit’ given my history of calling others out on it. Just like I was right to do…

  • You have a new security initiative? Great, here’s some advice…

    I am getting frustrated with the never-ending stream of ‘new’ security initiatives being announced. Doesn’t matter if they are community driven, compliance-based, or ‘industry standards’. For twenty years, we’ve heard it over and over, yet things just aren’t changing. Most of these initiatives flop. Some may make it months or even years, limping along with…

  • The Five High-level Types of Vulnerability Reports

    [This was originally published on the OSVDB blog.] Based on a Twitter thread started by Aaron Portnoy that was replied to by @4Dgifts asking why people would debunk vulnerability reports, I offer this quick high-level summary of what we see, and how we handle it. Note that OSVDB uses an extensive classification system (that is…

  • Crossing the line on ‘appropriate’ response to a breach…

    You have likely seen the news that eBay was compromised and disclosed on Wednesday the 21st, resulting in as many as 145 million customers being affected. eBay was quick to state that the criminals did not gain access to financial information, trying to allay customer concerns. Despite that, there are many aspects of the aftermath…

  • The Scraping Problem and Ethics

    [This was originally published on the OSVDB blog.] [2014-05-09 Update: We’d like to thank both McAfee and S21sec for promptly reaching out to work with us and to inform us that they are both investigating the incident, and taking steps to ensure that future access and data use complies with our license.] Every day we…

  • The problem with SCADA goes deeper…

    [This was originally published on the OSVDB blog.] We know SCADA is virtual swiss cheese, ready to be owned if someone can reach a device. We have preached airgaps for decades, even before we knew how bad the software was. Back then it was just, “this is so critical, it has to be separate!” The…

  • The Death and Re-birth of the Full-Disclosure Mail List

    [This was originally published on the OSVDB blog.] After John Cartwright abruptly announced the closure of the Full Disclosure mail list, there was a lot of speculation as to why. I mailed John Cartwright the day after and asked some general questions. In so many words he indicated it was essentially the emotional wear and…