721
Eliminating Memory Safety Vulnerabilities at the Source
Posted by Jeff Vander Stoep - Android team, and Alex Rebert - Security Foundations Memory safety vulnerabilities remain a pervasive threa...
New
The latest blog posts to take off on Hacker News. 4,439 posts.
722
723
Firefox tracks you with “privacy preserving” feature
noyb filed a complaint against Mozilla for quietly enabling a supposed “privacy feature” (called Privacy Preserving Attribution) in its Firefox browser which tracks user behaviour on websites.
724
Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
a post going over 4 exploits for CVE-2024-20017, a remotely exploitable buffer overflow in a component of the MediaTek MT7622 SDK.
725
726
Is Tor still safe to use?
This blog post is a response to an investigative news report about a large-scale law-enforcement attack that managed to de-anonymize a user of an old version of the long-retired app Ricochet. This blog post aims to provide insight into what we know so far. Nothing that the Tor Project has learned about this incident…
727
0day Contest for End-of-Life Devices Announced
The Junkyard contest focuses on deprecated systems, responsible disclosure, and meme-worthy exploits. Join us today!
728
Warning: DNS encryption in Little Snitch 6.1 may occasionally fail
UPDATE: Spoke too soon… The problem discussed here turned out to be specific to Little Snitch 6.1 and not a general issue in macOS. It has already been fixed in Little Snitch 6.1.1. See the end of the article for details. DNS Encryption 101 When…
729
Void captures over a million Android TV boxes
Doctor Web experts have uncovered yet another case of an Android-based TV box infection. The malware, dubbed <a href="https://vms.drweb.com/search/?q=Android.Vo1d&lng=en"><b>Android.Vo1d</b></a>, has infected nearly 1.3 million devices belonging to users in 197 countries. It is a backdoor that puts its components in…
730
731
Better-performing “25519” elliptic-curve cryptography
Automated reasoning and optimizations specific to CPU microarchitectures improve both performance and assurance of correct implementation.
732
Vulnerabilities in the Feeld dating app
Discover critical Feeld app vulnerabilities from our pentest. See how flaws in security controls expose personal data and learn key fixes.
733
We spent $20 to achieve RCE and accidentally became the admins of .mobi
Welcome back to another watchTowr Labs blog. Brace yourselves, this is one of our most astounding discoveries. Summary What started out as a bit of fun between colleagues while avoiding the Vegas heat and $20 bottles of water in our Black Hat hotel rooms - has now seemingly become a major
734
Hacking misconfigured AWS S3 buckets: A complete guide
AWS S3 (Simple Storage Service) buckets are a popular storage service used by software companies and organizations to store public as well as sensitive data. However, the implementation of this servic...
735
Nobody Cares About Security
Nobody cares about security. There. I said it. I said the thing everyone feels, some people think, but very few have the temerity to say out loud. But before you call me...
736
"Unstripping" binaries: Restoring debugging information in GDB with Pwndbg
GDB loses significant functionality when debugging binaries that lack debugging symbols (also known as “stripped binaries”). Function and variable names become meaningless addresses; setting breakpoints requires tracking down relevant function addresses from an external source; and printing out structured values…
737
Keyhole – Forge own Windows Store licenses
By WitherOrNot
738
EUCLEAK Side-Channel Attack on the YubiKey 5 Series
Download the Writeup Illustration Romain Flamand – Flamingo Studio – flamandromain@gmail.com Abstract Secure elements are small microcontrollers whose main purpose is to generate/store secrets and then execute cryptographic operations. They undergo the highest level of security evaluations that exists (Common…
739
OAuth from First Principles
I've wanted to write a blog post for everyone who learns things the same way that I do; by trying to break them. I'll start off with an awfully flawed implementation that authorizes a user with a 3...
740
741
Chrome is entrenching third-party cookies that will mislead users
Related Website Sets is a user-hostile weakening of the Web's privacy model, plainly designed to benefit websites and advertisers, to the detriment of user privacy.
742
743
Vulnerabilities show why STARTTLS should be avoided if possible (2021)
Guest Post: Study finds more than 40 STARTTLS-related security flaws in many different software products, both client-side and server-side.
744
Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US
Met deze test controleren we of u een mens bent. Hiermee voorkomen we ongeoorloofd gebruik van deze dienst.
745
Birds aren't real – how to create your own "bird"
Did you know that birds aren't real? They are actually mobile devices that have cameras and microphones to maintain surveillance by the government. You may be asking yourself why they do not just use the cell phones in everyone's pocket; hey, I don't know; I don't make the rules.Now that I have completely destroyed my…
746
OpenSSH Backdoors
Imagine this: an OpenSSH backdoor is discovered, maintainers rush to push out a fixed release package, security researchers trade technical details on mailing lists to analyze the backdoor code. Speculation abounds on the attribution and motives of the attacker, and the tech media pounces on the story. A near miss
747
“YOLO” is not a valid hash construction
Among the cryptographic missteps we see at Trail of Bits, “let’s build our own tool out of a hash function” is one of the most common. Clients have a problem along the lines of “we need to hash a bunch of different values together” or “we need a MAC” or “we need […]
748
Data Exfiltration from Slack AI via indirect prompt injection
Authors: PromptArmor
749
The spies in your home: How WiFi companies monitor your private life
Data harvesters are reaching into virtually every part of your digital life through the little-known surveillance hardware industry.
750
