871
New PHP Vulnerability:?-s may expose source code for mod_cgi
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 900 posts.
872
Cross-Account Container Takeover in Azure Container Instances
Affecting Azure Container Instances, Azurescape is the first known cross-account container takeover in the public cloud.
873
Improving privacy and security on the web
In 2008, we launched Chrome with the goal of building a speedy, simple, secure and stable web for everyone, everywhere. Ten years later, use...
874
Clover Health: How Chamath Lured Retail Investors into a Broken Business
Initial Disclosure: This report represents our opinion, and we encourage every reader to do their own due diligence. Please see our full disclaimer at the bottom of the report. We have no position (short or long) in Clover Health because we think in this moment for public markets, it is more important for people to…
875
EU member states still cannot agree about end-to-end encryption
Stanford Center for Internet and Society2023119 points147 commentscited by 3Society, Policy & Culture details
Recently, Wired reported on documents leaked in May from the Council of the European Union’s ongoing deliberations over the draft Child Sex Abuse Regulation. The proposal is controversial because, as presently written, it would require online service providers to proactively scan their services – including users’…
876
877
Cloudflare Access: Like BeyondCorp, but You Don’t Have to Be at Google to Use It
Tell me if this sounds familiar: any connection from inside the corporate network is trusted and any connection from the outside is not. This is the security strategy used by most enterprises today. The problem is that security is breached, the attacker has access to everything.
878
879
Doodles, stickers, and censorship circumvention for Signal Android
The latest Signal for Android release includes support for adding doodles, stickers, and text to images. This release also includes support for censorship circumvention in Egypt and the United Arab Emirates.
880
Leaked admin access token to Python, PyPI, and PSF GitHub repos
The JFrog Security Research team has recently discovered and reported a leaked access token with administrator access to Python’s, PyPI’s and Python Software Foundation’s GitHub repositories, which was leaked in a public Docker container hosted on Docker Hub. As a community service, the JFrog Security Research team…
881
882
Github: Token authentication requirements for Git operations
Beginning August 13th, 2021, we will no longer accept account passwords when authenticating Git operations on GitHub.com.
883
1Password X: A look at the future of 1Password in the browser
1Password X is our brand new, full-featured experience that runs entirely in your browser. Find out what it can do.
884
885
Limiting Private API Availability in Chromium
During a recent audit, we discovered that some third-party Chromium based browsers were able to integrate Google features, such as Chrome sy...
886
887
Arti, a pure-Rust Tor implementation
Greetings! Today I'm happy to announce a new era in Tor implementation. Over the past year or so, we've been working on "Arti", a project to rewrite Tor in Rust. Thanks to funding from Zcash Open Major Grants (ZOMG), we can finally put the Arti project up in our priorities list, and devote more time to it. Below I'll…
888
The Million-Key Question: Investigating the Origins of RSA Public Keys
Petr Švenda, Matúš Nemec, Peter Sekan, Rudolf Kvašňovský, David Formánek, David Komárek, and Vashek Matyáš, Masaryk University
889
890
Run your own CTF: Stripe publishes VM images
Online payment processing for internet businesses. Stripe is a suite of payment APIs that powers commerce for businesses of all sizes.
891
892
An Armful of CHERIs
Microsoft Security Response Center Blog2022105 points24 commentscited by 3Security & Privacy details
Today, Arm announced that the first silicon supporting the Morello prototype architecture, a research project led by Arm, Microsoft, University of Cambridge and others, is now available on a limited run of demonstration boards, which are being shipped from today to industry partners for testing. Morello is the first…
893
894
TPM Sniffing
TL;DR : we reproduced Denis Andzakovic’s proof-of-concept showing that it is possible to read and write data from a BitLocker-protected device (for instance, a stolen laptop) by sniffing the TPM key from the LCP bus.
895
The real reason for large DDoS attacks? It's IP Spoofing, not memcached
A week ago we published a story about new amplification attacks using memcached protocol on UDP port 11211. A few things happened since then: Github announced it was a target of 1.3Tbps memcached attack. OVH and Arbor reported similar large attacks with the peak reported at 1.7Tbps.
896
897
898
Insecure by design: protocols for encrypted phone calls
The MIKEY-SAKKE protocol is being promoted by the UK government as a better way to secure phone calls. The reality is that MIKEY-SAKKE is designed to offer minimal security while allowing undetectable mass surveillance, through the introduction a backdoor based around mandatory key-escrow. This weakness has…
899
Huawei HKSP Introduces Trivially Exploitable Vulnerability in the Linux Kernel
Huawei has seemingly stepped its foot into the kernel self-protection game with the release of HKSP. Absent any threat model and riddled with weaknesses, it also introduces a trivially exploitable local root vulnerability due to a complete lack of defensive programming.
900
Defense Against AI-Guided Traffic Analysis (Daita)
Even if you have encrypted your traffic with a VPN (or the Tor Network), advanced traffic analysis is a growing threat against your privacy. Therefore, we now introduce DAITA.