Cloudlbleed

Here just the critical links to this saga. Thanks to my friend MJ for bringing this to my attention! [image credit: Google]

The Cloudbleed Story:

'Cloudbleed': what a metaphor in a name, or is it the other way round?

Article by Thomas Fox-Brewster of Forbes:
https://www.forbes.com/sites/thomasbrewster/2017/02/24/google-just-discovered-a-massive-web-leak-and-you-might-want-to-change-all-your-passwords/#1848cf543ca3

...which refers to the finder of the bug, Tavis Ormandy, and this blog post:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1139

And Cloudflare's announcement, which includes many technical details worth reading:
https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/
... which lays out the root cause (sigh)
/* generated code */
if ( ++p == pe )
    goto _test_eof;
The root cause of the bug was that reaching the end of a buffer was checked using the equality operator and a pointer was able to step past the end of the buffer. This is known as a buffer overrun. Had the check been done using >= instead of == jumping over the buffer end would have been caught.

Incidentals:

What is Google Project Zero? And why does it exist? Pretty fascinating, actually:
Project Zero is the name of a team of security analysts employed by Google tasked with finding zero-day vulnerabilities. It was announced on 15 July 2014. [wikipedia] https://en.wikipedia.org/wiki/Project_Zero_(Google)
The Wikipedia summary is definitely worth a read.

And the Project Zero blog:
https://googleprojectzero.blogspot.com/

#cloudbleed #cloudflare #GoogleProjectZero 

An impressive-looking Apple ID phishing page

Just now I received this email. It's a classic example of phishing.
There is something clearly wrong here...

... this is not likely a valid Apple email address: 

Apple <kocobanjir@mail-trustsend.com>

I moused-over the "iforgot.apple.com" hyperlink, which actually goes to 

https://se-curelink.com/apple. 

This is clearly not in the apple domain.

Curious, I clicked on that and wound up at this authentic-looking web page at 

https://www-applied.com-manage-security.com/Login.php

It's one of the more clever phishing attacks I've seen recently.
Looks pretty real, doesn't it? That's because it is a complete copy of the real Apple page:

In case you wonder, the real page https://iforgot.apple.com looks like this:

Now I'm going to report this as a phishing page at 
https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en

This exact attack has been around at other addresses, for example here.