Informationweek Influencer

dragosr (@dragosr)

Twitter Bio:: Stop, Think, Pwn!
Location:: Vortex of Cool
Website:: http://cansecwest.com

What is This?

dragosr's

Network

dragosr's Selections From the Web

DSL modem hack used to infect millions with banking fraud malware

|9 Influencers

Millions of Internet users in Brazil have fallen victim to a sustained attack that exploited vulnerabilities in DSL modems, forcing people visiting sites such as Google or Facebook to reach imposter sites that installed malicious software and stole online banking credentials, a security researcher said.The attack, described late last week during a presentation at the Virus Bulletin conference in Dallas, infected more than 4.5 million DSL modems, said Kaspersky Lab Expert Fabio Assolini, citing statistics provided by Brazil's Computer Emergency Response Team. The CSRF (cross-site request forgery) vulnerability allowed attackers to use a simple

How a Google Headhunter's E-Mail Unraveled a Massive Net Security Hole | ...

|8 Influencers

Mathematician Zach Harris, 35, of Jupiter, Fl., poses for a portrait on Tuesday. Photo: Brynn Anderson/WiredIt was a strange e-mail, coming from a job recruiter at Google, asking Zachary Harris if he was interested in a position as a site-reliability engineer.“You obviously have a passion for Linux and programming,” the e-mail from the Google recruiter read. “I wanted to see if you are open to confidentially exploring opportunities with Google?”Harris was intrigued, but skeptical. The e-mail had come to him last December completely out of the blue, and as a mathematician, he didn’t seem the likeliest candidate for the job Google was pitching.

Cracking Story -- How I Cracked Over 122 Million SHA1 and MD5 Hashed Passwords

|5 Influencers

This is the story about how I cracked 122 million unique passwords using John the Ripper and oclHashcat-plus.

It was several months ago, when I saw a tweet from KoreLogic about a torrent fileÂ containing various password hash lists for a total ofÂ 146 millionÂ passwords. This very big amount of password hashes at first discouraged me, as I only ownÂ

Stuffing Javascript into DNS names

|5 Influencers

Today seemed like a fun day to write about a really cool vector for cross-site scripting I found. In my testing, this attack is pretty specific and, in some ways, useless, but I strongly suspect that, with resources I don't have access to, this can trigger stored cross-site scripting in some pretty nasty places. But I'll get to that!

Interestingly enough, between the time that I wrote this blog/tool and published it, nCircle researchers have said almost the same thing (