3361
HackedThat: Breaking in to a hardened server via the back door
Earlier this summer, the team atInversoft published a comprehensive andsophisticatedguide to user data security. Theguide spans from hardening servers from p...
New
The latest blog posts to take off on Hacker News. 4,441 posts.
3362
NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender
Ahmed Mansoor was targeted by NSO Group, an Israel-based “cyber war” company that sells Pegasus, a government-exclusive “lawful intercept” spyware product.
3363
3364
We Shouldn’t Wait Another 15 Years for a Conversation About Government Hacking
With high-profile hacks in the headlines and government officials trying to reopen a long-settled debate about encryption, information security has become a mainstream issue. But we feel that one element of digital security hasn’t received enough critical attention: the role of government in...
3365
Bitcoin 0.13.0 Binary Safety Warning
Bitcoin.org has reason to suspect that the binaries for the upcoming Bitcoin Core release will likely be targeted by state sponsored attackers. As a website, Bitcoin.org does not have the technical resources to guarantee that we can defend ourselves from attackers of this calibre. We ask the Bitcoin community, and in…
3366
Cisco Adaptive Security Appliance SNMP Remote Code Execution Vulnerability
A vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to a buffer overflow in the affected code area. The…
3367
With Windows 10, Microsoft Disregards User Choice and Privacy
Microsoft had an ambitious goal with the launch of Windows 10: a billion devices running the software by the end of 2018. In its quest to reach that goal, the company aggressively pushed Windows 10 on its users and went so far as to offer free upgrades for a whole year. However, the company’s...
3368
3369
VeraCrypt to be audited
OSTIF is proud to announce that we have come to an agreement to fully fund an audit of VeraCrypt. Using funds that were donated by DuckDuckGo and VikingVPN , we plan to hire QuarksLab to go over the code and search for vulnerabilities and backdoors.
3370
3371
DDoSCoin: Cryptocurrency with malicious proof of work
Eric Wustrow, University of Colorado Boulder; Benjamin VanderSloot, University of Michigan
3372
ProtonMail now the maintainer of OpenPGPjs email encryption library
OpenPGPjs is the world's most popular JavaScript PGP email encryption library and is used by millions of end users and hundreds of developers.
3373
The Million-Key Question: Investigating the Origins of RSA Public Keys
Petr Švenda, Matúš Nemec, Peter Sekan, Rudolf Kvašňovský, David Formánek, David Komárek, and Vashek Matyáš, Masaryk University
3374
Flash and Chrome
Chrome will de-emphasize Flash in favor of HTML5, giving you improved security, reduced power consumption and faster page load times.
3375
90-year-old Cryptanalytic Efforts Must Stay Secret, says NSA
The National Security Agency is withholding 90-year-old information on early American cryptanalytic efforts against Russia and the Soviet Union from a 20-year-old document on the grounds that relea…
3376
TLS Everywhere, not https: URIs (2015)
A few years after HTTP appeared, around when W3C was founded in 1994, it was clear that an unencrypted and unauthenticated connection was too much of a liability for a lot of serious stuff, such as e-commerce, which everyone wanted to do on the web. (In those days, mass Deep Packet Inspection was not technically…
3377
iOS 10 to Feature Stronger “Limit Ad Tracking” Control
The release of iOS 10, the newest version of Apple's mobile operating system (coming this Fall), will bring an array of new features and upgrades, and a change to the functionality of the "Limit Ad Tracking" privacy setting.
3378
3379
Bringing HSTS to www.google.com
Posted by Jay Brown, Sr. Technical Program Manager, Security For many years, we’ve worked to increase the use of encryption between our us...
3380
3381
LastPass autofill exploit
Mathias Karlsson decided to check out the security of the LastPass browser extensions. Here's what he found.
3382
Let's Encrypt now fully supports IPv6
Let’s Encrypt is happy to announce full support for IPv6. As IPv4 address space is exhausted, more and more people are deploying services that are only reachable via IPv6. Adding full support for IPv6 allows us to serve more people and organizations, which is important if we’re going to encrypt the entire Web. IPv6 is…
3383
World of Warcraft: one simple line of code can cost you dearly
A few days ago, a new type of gold/item scam made the rounds. Usually scamming in MMORPGs is done using social engineering techniques, e.g. an attacker sells a fake item code for alleged in-game items like mounts to a potential victim for in-game currency. But this most recent kind of attack does not only involve…
3384
HTTPS Adoption doubled this year
Despite having been around for over 20 years, HTTPS always remained very lightly adopted – until 2016. Data from two independent sources shows that HTTPS adoption more than doubled from 2015 to 2016. Snyk CEO Guy Podjarny digs into this data.
3385
3386
Apple Remote Code Execution with Image Files
Vulnerabilities discovered by Tyler Bohan of Cisco Talos. Many of the wide variety of file formats are designed for specialized uses within specific industries. Apple offers APIs as interfaces to provide a definitive way to access image data for multiple image formats on the Apple OS X platform. Talos is
3387
Reducing Adobe Flash Usage in Firefox
Browser plugins, especially Flash, have enabled some of our favorite experiences on the Web, including videos and interactive content. But plugins often introduce stability, performance, and security issues for browsers. ...
3388
Windows Hello face recognition is vulnerable to the Jedi mind trick
Practical development throughout the evolution of Windows.
3389
3390
Executing non-alphanumeric JavaScript without parentheses
I decided to look into non-alphanumeric JavaScript again and see if it was possible to execute it without parenthesis. A few years ago I did a presentation on non-alpha code if you want some more info