691
Are We PEP740 Yet?
PEP 740 is a Python standard for defining cryptographically verifiable attestations hosted by indices like PyPI.
New
The latest blog posts to take off on Hacker News. 4,439 posts.
692
PyPI now supports digital attestations
Announcing support for PEP 740 on the Python Package Index
693
A memory leak in Apple's Network Extension framework
Is it normal for the Little Snitch Network Extension to consume Gigabytes of memory? No it isn’t. Unfortunately that’s another new bug in the Network Extension framework of macOS. It’s a memory leak in Apple’s framework, which developers…
694
695
The Beginner's Guide to Visual Prompt Injections (2023)
Learn about visual prompt injections, their appearance, and top defense strategies against these attacks.
696
Abusing Ubuntu 24.04 features for root privilege escalation
With the recent release of Ubuntu 24.04, we at Snyk Security Labs thought it would be interesting to examine the latest version of this Linux distribution to see if we could find any interesting privilege escalation vulnerabilities.
697
Early Cascade Injection: From Windows process creation to stealthy injection
Get an introdcution to Early Cascade, a novel process injection technique that is effective against top tier EDRs while avoiding detection.
698
Hyperlight: Virtual machine-based security for functions at scale
The Microsoft Azure Core Upstream team is excited to announce the Hyperlight project, an open-source Rust library you can use to create very small VMs for embedded functions. Learn more.
699
Combining Machine Learning and Homomorphic Encryption in the Apple Ecosystem
At Apple, we believe privacy is a fundamental human right. Our work to protect user privacy is informed by a set of privacy principles, and…
700
Using Large Language Models to Catch Vulnerabilities
Posted by the Big Sleep team Introduction In our previous post, Project Naptime: Evaluating Offe...
701
Fuzzing between the lines in popular barcode software
Fuzzing—one of the most successful techniques for finding security bugs, consistently featured in articles and industry conferences—has become so popular that you may think most important software has already been extensively fuzzed. But that’s not always the case. In this blog post, we show how we fuzzed the ZBar…
702
CFPB finalizes personal financial data rights rule
The Consumer Finance Protection Bureau (CFPB) has just finalized a rule that makes it easy and safe for you to figure out which bank will give you the best deal and switch to that bank, with just a couple of clicks. We love this kind of thing: the coolest thing about a digital world is how easy it...
703
Security research on Private Cloud Compute
Private Cloud Compute (PCC) fulfills computationally intensive requests for Apple Intelligence while providing groundbreaking privacy and security protections — by bringing our industry-leading device security model into the cloud. To build public trust in our system, we’re making it possible for researchers to…
704
Lawsuit challenges Virginia City's use of cameras for warrantless surveillance
NORFOLK, Va.—Today, two Norfolk-area residents teamed up with the Institute for Justice (IJ) to file a federal lawsuit against the city, challenging the constitutionality of […]
705
Fearless SSH: Short-lived certificates bring Zero Trust to infrastructure
Access for Infrastructure, BastionZero’s integration into Cloudflare One, will enable organizations to apply Zero Trust controls to their servers, databases, Kubernetes clusters, and more. Today we’re announcing short-lived SSH access as the first available feature of this integration.
706
Rustls Outperforms OpenSSL and BoringSSL
ISRG has been investing heavily in the Rustls TLS library over the past few years. Our goal is to create a library that is both memory safe and a leader in performance. Back in January of this year we published a post about the start of our performance journey. We've come a long way since then and we're excited to…
707
708
U.S. border surveillance towers have always been broken
A new bombshell scoop from NBC News revealed an internal U.S. Border Patrol memo claiming that 30 percent of camera towers that compose the agency's "Remote Video Surveillance System" (RVSS) program are broken. Except, this isn't a bombshell. What should actually be shocking is that Congressional leaders are acting…
709
Should We Chat, Too? Security Analysis of WeChat's Mmtls Encryption Protocol
This report performs the first public analysis of MMTLS, the main network protocol used by WeChat, an app with over one billion users. The report finds that MMTLS is a modified version of TLS, however some of the modifications have introduced cryptographic weaknesses.
710
MacOS sometimes leaks traffic after system updates
We have found that you could be leaking traffic on macOS after system updates. To our current knowledge a reboot resolves it. We are currently investigating this and will follow up with more information.
711
FIDO Alliance publishes new spec to let users move passkeys across providers
The FIDO Alliance has published a working draft of a new set of specifications for secure credential exchange that, when standardized and implemented by
712
"Begin disabling installed extensions still using Manifest V2 in Chrome stable"
Details of the Manifest V2 phase-out and end of life.
713
A free and open internet shouldn't come at the expense of privacy
MARK SURMAN, PRESIDENT, MOZILLA Keeping the internet, and the content that makes it a vital and vibrant part of our global society, free and accessible has
714
European govt air-gapped systems breached using custom malware
ESET Research analyzed two separate toolsets for breaching air-gapped systems, used by a cyberespionage threat actor known as GoldenJackal.
715
How to stop advertisers from tracking your teen across the internet
When children turn 13, they age out of the data protections provided by the Children’s Online Privacy Protection Act (COPPA). Then, they become targets for data collection from data brokers that collect their information from social media apps, shopping history, location tracking services, and more.
716
Mitmproxy 11: Full HTTP/3 Support
We are excited to announce the release of mitmproxy 11, which introduces full support for HTTP/3 in both transparent and reverse proxy modes. We’re also bringing in a ton of DNS improvements that we’ll cover in this blog post.
717
Perfctl: Stealthy malware targeting Linux servers
Perfctl is particularly elusive and persistent malware employing several sophisticated techniques
718
EU: Definition of "potential terrorists" opens door to broad information-sharing
EU member states can now collect and share information on “potential terrorists”. This category is based on a new informal definition that was agreed with no democratic scrutiny. While claiming to target those who may engage in political violence, there is potential for far broader application.
719
FTC Report Confirms: Commercial Surveillance Is Out of Control
A new Federal Trade Commission (FTC) report confirms what EFF has been warning about for years: tech giants are widely harvesting and sharing your personal information to fuel their online behavioral advertising businesses.
720
AWS Nitro Enclaves: Attack Surface
In the race to secure cloud applications, AWS Nitro Enclaves have emerged as a powerful tool for isolating sensitive workloads. But with great power comes great responsibility-and potential security pitfalls. As pioneers in confidential computing security, we at Trail of Bits have scrutinized the attack surface of AWS…