1051
An EPYC escape: Case-study of a KVM breakout
Posted by Felix Wilhelm, Project ZeroIntroduction KVM (for Kernel-based Virtual Machine) is the ...
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 1,584 posts.
1052
Infineon RSA Key Generation Issue
Learn more about what's happening within the tech and cybersecurity industry and the developments in our business and security keys within our Yubico Blog.
1053
Google to default to SSL version for logged in users
Insights from Googlers into our products, technology, and the Google culture
1054
Reducing Adobe Flash Usage in Firefox
Browser plugins, especially Flash, have enabled some of our favorite experiences on the Web, including videos and interactive content. But plugins often introduce stability, performance, and security issues for browsers. ...
1055
1056
Exploiting aCropalypse: Recovering truncated PNGs
This article assumes you’ve already heard about the aCropalypse vulnerability, aka CVE-2023-21036. If not, go read about it here (oops, this page doesn't exist yet. Read this tweet in the meantime).
1057
1058
Breaking the Ledger Security Model
In this post, I’m going to discuss a vulnerability I discovered in Ledger hardware wallets. The vulnerability arose due to Ledger’s use of a custom architecture to work around many of the limitations of their Secure Element.
1059
HTTP/2 rapid reset attack impacting Nginx products
Deliver modern applications with NGINX. Explore high-performance load balancing, API gateways, and web server solutions trusted by top global enterprises.
1060
The ways we contain Claude across products
As agents grow more capable, so does their potential blast radius. Here's what we learned building containment for claude.ai, Claude Code, and Cowork.
1061
AWS deleted my 10-year account and all data without warning
After 10 years as an AWS customer and open-source contributor, they deleted my account and all data with zero warning. Here's how AWS's 'verification' process became a digital execution, and why you should never trust cloud providers with your only copy of anything.
1062
New ways we're tackling spammy, low-quality content on Search
We’re making updates to show less unoriginal, low-quality content on Search.
1063
ETS Isn't TLS and You Shouldn't Use It
The good news: TLS 1.3 is available, and the protocol, which powers HTTPS and many other encrypted communications, is better and more secure than its predecessors (including SSL). The bad news: Thanks to a financial industry group called BITS, there’s a look-alike protocol brewing called ETS (or...
1064
1065
Malware Hidden Inside JPG EXIF Headers
A few days ago, Peter Gramantik from our research team found a very interesting backdoor on a compromised site. This backdoor didn’t rely on the…
1066
The God Login
I graduated with a Computer Science minor from the University of Virginia in 1992. The reason it’s a minor and not a major is because to major in CS at UVa you had to go through the Engineering School, and I was absolutely not cut out for that kind
1067
Removing Old Versions of TLS
In March of 2020, Firefox will remove support for TLS 1.0 and TLS 1.1.
1068
A bug related to handling of authenticated sessions
On the evening of March 8, we invalidated all authenticated sessions on GitHub.com created prior to 12:03 UTC on March 8 out of an abundance of caution.
1069
Secure Access to 100 AWS Accounts
Explore technical topics, solutions, and resources for building with Twilio – and beyond.
1070
Adding a security key to Gmail
Your primary email (the one you give to banks, social media sites, etc.) is the most important online account you have. If an attacker can take over your primary email account, they can reset passwords on every other service that uses that email for account recovery.
1071
1072
Backdooring JavaScript using minifier bugs
In addition to unforgettable life experiences and personal growth, one thing I got out of DEF CON 23 was a copy of POC||GTFO 0x08 from Travis Goodspeed. The coolest article I’ve read so far in it is “Deniable Backdoors Using Compiler Bugs,” in which the authors abused a pre-existing bug in CLANG to create a backdoored…
1073
1074
Freedom Act Passes: What We Celebrate, What We Mourn, and Where We Go from Here
The Senate passed the USA Freedom Act today by 67-32, marking the first time in over thirty years that both houses of Congress have approved a bill placing real restrictions and oversight on the National Security Agency’s surveillance powers. The weakening amendments to the legislation proposed by...
1075
Some thoughts on Spectre and Meltdown
The story of these attacks starts in late 2004. I had submitted my doctoral thesis and had a few months before flying back to Oxford for my defense, so I turned to some light reading: Intel's latest "Optimization Manual", full of tips on how to write faster code. (Eking out every last nanosecond of performance has…
1076
HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
The “HTTP/2 Rapid Reset” attack exploits a weakness in the HTTP/2 protocol to generate enormous, hyper-volumetric DDoS attacks. Cloudflare has mitigated a barrage of these attacks in recent months, including an attack three times larger than any previous attack we’ve observed
1077
1078
Codecov Bash Uploader compromised
Update 4/29/2021 3PM PT : Through our investigation, we now have additional information concerning what environment variables may have been obtained without authorization and how they may have been used. Affected users can view details within the Codecov application. Additionally, we have posted our most up-to-date…
1079
VMs won't contain cyber-capable agents
You can no longer assume a mere VM will contain a sufficiently advanced AI agent.
1080
Microsoft's Xandr grants GDPR rights at a rate of 0%
noyb has filed a GDPR complaint regarding transparency issues, the right of access and the use of inaccurate information about users