On the standard Blackberry Web Browser, there is a fixed file download limit of 2.3MB. Many users avoid this by installing a 3rd party browser (such as Opera Mini, for example), but there is still that bitter taste for having an extra web browser around just to download decently sized files. This limit seems to be imposed by a certain WAP port that the Blackberry is set to use by default, which blocks any file greater than this. Fortunately, [0mie] has found a way to reconfigure the default Blackberry Browser to use a different port without this restriction. Step by step walk through, links to the file required, and screen shots of large file downloads are provided. [0mie] claims that this hack works on a number of different phones and OS versions, and we are sure he would appreciate a wider audience to test this with.
[Note: This hack seems to use a Chinese provider as a proxy, so there may be privacy issues, etc. As always, hack at your own risk.]
Last week at Black Hat DC, [Moxie Marlinspike] presented a novel way to hijack SSL. You can read about it in this Forbes article, but we highly recommend you watch the video. sslstrip can rewrite all https links as http, but it goes far beyond that. Using unicode characters that look similar to / and ? it can construct URLs with a valid certificate and then redirect the user to the original site after stealing their credentials. The attack can be very difficult for even above average users to notice. This attack requires access to the client’s network, but [Moxie] successfully ran it on a Tor exit node.
Google Chrome made a huge splash in the past week, but will it really change the way you browse, and convince you to switch from your current browser? For those who want to play with it but don’t want Google to completely take over their lives, Chromium is the open source project behind Google Chrome. Linux and OS X users can also run Chrome using WINE, although success is not guaranteed. To make an educated choice, read Scott McCloud’s comic which explains the underpinnings. Make sure you’re aware of Chrome’s security vulnerabilities, and take advantage of Lifehacker’s guide to make your browsing experience as convenient and useful as possible. There are some great features, including the ability to log into multiple Google accounts using its much-lauded Incognito mode, which prevents Google Chrome from logging information on your browsing and downloading habits (websites you browse can still track your information). For convenience, you can also install Chrome on a USB drive, and take it anywhere with you. Explore the many Google Chrome blogs that have popped up to provide advice on hacking and tweaking the browser. Or you could just get all your information from 4chan.
The webcast for Google’s new Chrome browser starts at 11PDT. The browser is supposed to feature better memory management. Right now they’re opening with Led Zeppelin and Queen, so I guess it’s supposed to be rockin’ as well. Download it for Windows here. Chromium source available here.
IBM’s X-Force security team has released a mid-year report(PDF) stating that the number of zero-day exploits is growing at an alarming rate. For those of you unfamiliar with the term, a zero-day exploit is a program that is created and implemented within 24 hours of the disclosure of a security flaw. These exploits usually affect users before they even know the vulnerability exists and long before a patch is made available. The researchers also found that many of these exploits were targeted at browser plug-ins, which most users utilize on a daily basis.
[Kris Lamb], X-Force operations manager, is blaming the problem on a lack of a unified process for disclosing vulnerabilities. He also claims that the long-held practice of publishing example code of vulnerabilities should be frowned upon.