MoltenGL – Molten: "On both iOS and macOS, applications and games built on OpenGL ES 2.0 can use MoltenGL to provide the additional graphic performance, debugging, and performance-tuning capabilities available through Metal, without having to abandon the familiar OpenGL ES 2.0 API, or rewrite rendering logic and shaders for a different platform."

Labels: OpenGLES

Google rolls out HSTS • The Register: "The HSTS automatically forces browsers to upgrade insecure HTTP connections to encrypted HTTPS. Google tried rolling it out at the end of last year but faced technical issues that knocked the Chocolate Factory's Santa tracking service offline."

Labels: security policy

Apple's Ivan Krstic to give 'behind the scenes' iOS security talk at Black Hat USA: "Ivan Krstic will explore the "cryptographic design and implementation of our novel secure synchronization fabric" as it relates to technology like HomeKit, Auto Unlock, and iCloud Keychain, according to Apple. The briefing, scheduled for Aug. 4, will also go into the Secure Enclave present on Touch ID-capable devices, and "a unique JIT hardening mechanism" intended to make Safari's JIT (Just-in-Time) compiler a harder target."

Labels: security policy

Kim Dotcom’s lawyer will also represent alleged KickassTorrents founder | Ars Technica: "Just over a week ago, federal authorities announced the arrest of Artem Vaulin, a Ukrainian man that they say is the mastermind of KickassTorrents (KAT), which was the world’s largest BitTorrent search site until recently.

Vaulin, 30, has retained Ira Rothken, the California lawyer who has successfully kept Kim Dotcom out of custody in New Zealand since 2012. "

Labels: think different

New attack that cripples HTTPS crypto works on Macs, Windows, and Linux | Ars Technica: "A key guarantee provided by HTTPS encryption is that the addresses of visited websites aren't visible to attackers who may be monitoring an end user's network traffic. Now, researchers have devised an attack that breaks this protection."

Labels: security flaw

Hacker who published LA Times login credentials ordered to prison | Ars Technica: "The original headline said, "Pressure builds in House to pass tax-cut package." It was changed to "Pressure builds in House to elect CHIPPY 1337.""

Labels: security policy, yawn

Apple's latest software updates fix flaw resembling Android Stagefright: "Apple's recent iOS, OS X, tvOS and watchOS updates patch a previously unknown security flaw that allows the surreptitious gathering of sensitive data with a simple text message, an OS-level bug which bears a striking resemblance to last year's much derided Stagefright exploit on Google's Android platform."

Labels: security flaw

Critical flaw leaves all Apple devices open to password thieves: "Tyler Bohan, senior security researcher at Cisco Talos, has discovered a serious vulnerability in “ImageIO,” a framework built into Apple’s platforms that handle image data. Hackers are able to take advantage of this to steal passwords stored locally on your devices."

Labels: security vs. reusability

Alleged founder of world’s largest BitTorrent distribution site arrested | Ars Technica: "HSI and IRS looked into the historical hosting records of KAT and found that for about 3.5 years, ending in January 2016, the operation was hosted out of Chicago, Illinois, which explains why the case is now being prosecuted out of the Northern District of Illinois. The site also used a Canadian hosting service—the two American agencies also used MLAT to get an image of the Canadian server."

Labels: security policy

Crypto flaw made it easy for attackers to snoop on Juniper customers | Ars Technica: "As if people didn't already have cause to distrust the security of Juniper products, the networking gear maker just disclosed a vulnerability that allowed attackers to eavesdrop on sensitive communications traveling through customers' virtual private networks."

Labels: security flaw, security policy

HTTPS crypto’s days are numbered. Here’s how Google wants to save it | Ars Technica: "Like many forms of encryption in use today, HTTPS protections are on the brink of a collapse that could bring down the world as we know it. Hanging in the balance are most encrypted communications sent over the last several decades. On Thursday, Google unveiled an experiment designed to head off, or at least lessen, the catastrophe."

Labels: security policy, security research

Another Mac-specific malware pops up, but Apple's Gatekeeper still prevents infection: "A second piece of Mac-specific malware has been discovered this week, one that could expose the passwords stored in the macOS Keychain. But once again, Apple's Gatekeeper security — when properly configured — will block the attack from succeeding."

Labels: mac, mac os x, macOS, malware

Major weakness in Google's key storage breaks open Android's Full Disk Encryption: "Higher end Android phones using premium Qualcomm chips have been seeking to court the attention of enterprise users, but new research shows that Android encryption is easy to defeat because the devices store their disk encryption keys in software, unlike Apple's iOS."

Labels: security flaw