Almost Secure
palant.info
Content Creation
Claim pageClaim
Follow
Overview
News
Salaries
Products
People
Growth
Offices
Financials
News
Supporting Wayland's XDG activation protocol with Gtk/Glib
One of the biggest sore points with Wayland is its focus stealing protection. The idea is good: an application should not be able to bring itself into focus at an unexpected time, only when the currently active application allows it. Support is still lack
Read more
Report
Backdoors in VStarcam cameras
VStarcam is an important brand of cameras based on the PPPP protocol . Unlike the LookCam cameras I looked into earlier , these are often being positioned as security cameras. And they in fact do a few things better like… well, like having a mostly workin
Read more
Report
Analysis of PPPP "encryption"
My first article on the PPPP protocol already said everything there was to say about PPPP "encryption" : Keys are static and usually trivial to extract from the app. No matter how long the original key, it is mapped to an effective key that's merely four
Read more
Report
Unpacking VStarcam firmware for fun and profit
One important player in the PPPP protocol business is VStarcam. At the very least they've already accumulated an impressive portfolio of security issues. Like exposing system configuration including access password unprotected in the Web UI (discovered by
Read more
Report
An overview of the PPPP protocol for IoT cameras
My previous article on IoT "P2P" cameras couldn't go into much detail on the PPPP protocol. However, there is already lots of security research on and around that protocol, and I have a feeling that there is way more to come. There are pieces of informati
Read more
Report
A look at a P2P camera (LookCam app)
I've got my hands on an internet-connected camera and decided to take a closer look, having already read about security issues with similar cameras. What I found far exceeded my expectations: fake access controls, bogus protocol encryption, completely unp
Read more
Report
Analysis of an advanced malicious Chrome extension
Two weeks ago I published an article on 63 malicious Chrome extensions . In most cases I could only identify the extensions as malicious. With large parts of their logic being downloaded from some web servers, it wasn't possible to analyze their functiona
Read more
Report
Malicious extensions circumvent Google's remote code ban
As noted last week I consider it highly problematic that Google for a long time allowed extensions to run code they downloaded from some web server, an approach that Mozilla prohibited long before Google even introduced extensions to their browser. For ye
Read more
Report
Chrome Web Store is a mess
Let's make one thing clear first: I'm not singling out Google's handling of problematic and malicious browser extensions because it is worse than Microsoft's for example. No, Microsoft is probably even worse but I never bothered finding out. That's becaus
Read more
Report
BIScience: Collecting browsing history under false pretenses
This is a guest post by a researcher who wants to remain anonymous. You can contact the author via email . Recently, John Tuckner of Secure Annex and Wladimir Palant published great research about how BIScience and its various brands collect user data. Th
Read more
Report
Show more news