841
Social engineering takeovers of open source projects
By Robin Bender Ginn, Executive Director, OpenJS Foundation; and Omkhar Arasaratnam, General Manager, Open Source Security Foundation
New
The latest blog posts to take off on Hacker News. 4,440 posts.
842
DNS traffic can leak outside the VPN tunnel on Android
We were recently made aware of multiple potential DNS leaks on Android. They stem from bugs in Android itself, and only affect certain apps.
843
A recent security incident involving Dropbox Sign
Information on a security incident involving Dropbox Sign.
844
The AWS S3 Denial of Wallet Amplification Attack
If you publicly host large data files on AWS S3 & pay for transfer costs, you may be vulnerable to a “Denial of Wallet” amplification…
845
Passkey Implementation: Misconceptions, pitfalls and unknown unknowns
Read about the challenges, pitfalls and misconceptions we faced while developing our passkey-first authentication solution and passkey intelligence.
846
Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself
A USPS smishing attempt prompts the Akamai SIG to unearth shocking statistics: Illegitimate USPS domains see as much traffic as the legitimate USPS domain.
847
Xz sshd backdoor collecting usernames from logs
The amazingly scary xz sshd backdoor, Author: Bojan Zdrnja
848
Most dating apps sell and share users' personal data
Privacy Not Included was launched in 2017 to help you understand the privacy risks of tech products that connect to the internet. We are continuing that work in the form of Product Reviews at our magazine Nothing Personal, where our privacy experts do hours of hands-on testing and research on the most popular consumer…
849
Dnsmasq wins the first BlueHats Prize
BlueHats prizes is an initiative by the French Interministerial Digital Directorate. They are awarded to maintainers of critical free and open source projects. In 2024 four prizes of € 10 000 each will be given out. We are happy to announce the winner of the first 2024 BlueHats prize is Simon Kelley, maintainer of the…
850
851
Security Vulnerability in Browser Interface Allows Computer Access via GPU
Researchers at TU Graz were successful with three different side-channel attacks on graphics cards via the ... » Computer science and IT » Read more ▸
852
Tailscale SSH is now Generally Available
Tailscale SSH is now generally available, offering seamless SSH authentication and authorization with SSO, MFA, and ACLs. Enjoy robust security, zero trust remote access, and tools like session recording and VS Code integration.
853
Distributed Authorization
Using local data to answer authorization questions with Oso Cloud
854
XZ backdoor story – Initial analysis
Kaspersky analysis of the backdoor recently found in XZ, which is used in many popular Linux distributions and in OpenSSH server process.
855
Notepad++: Help us to take down the parasite website
I’ve received numerous complaints via email, social media, and forums regarding a website that poses a significant threat to our community. The copycat site in question is https://notepad.plus/ which appears prominently when users google for “download Notepad++”.
856
Google Public DNS's approach to fight against cache poisoning attacks
Tianhao Chi and Puneet Sood, Google Public DNS The Domain Name System (DNS) is a fundamental protocol used on the Internet to translate hum...
857
The V8 Sandbox
V8 features a lightweight, in-process sandbox to limit the impact of memory corruption bugs
858
Kobold letters: HTML emails are a risk
Anyone who has had to deal with HTML emails on a technical level has probably reached the point where they wanted to quit their job or just set fire to all the mail clients due to their inconsistent implementations. But HTML emails are not just a source of frustration, they can also be a serious security risk.
859
Tips for linking shell companies to their secret owners
At a recent panel at the 2024 NICAR conference, Karrie Kehoe, deputy head of data and research at ICIJ, offered a series of tips for investigating the true owners of shell companies.
860
OWASP Data Breach Notification
OWASP Data Leak Notification on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.
861
862
Someone has been attempting to DDoS us for weeks and we do nothing
Someone has been attempting to DDoS us for weeks now. They have flooded our server with hundreds of millions of requests and attempted to download our setup…
863
Equinix: Major Accounting Manipulation, Core Business Decay
Initial Disclosure: After extensive research, we have taken a short position in shares of Equinix, Inc. (NASDAQ:EQIX). This report represents our opinion, and we encourage every reader to do their own due diligence. Please see our full disclaimer at the bottom of the report.
864
ZenHammer: Rowhammer attacks on AMD Zen-based platforms
Our work shows that it is possible to trigger Rowhammer bit flips on DDR4 devices on AMD Zen 2 and Zen 3 systems despite deployed TRR mitigations. This result proves that AMD systems are equally vulnerable to Rowhammer as Intel systems , which greatly increases the attack surface, considering today’s AMD market share…
865
FlipperZero: Our Response to the Canadian Government
In just a few years, Flipper Zero has become so popular that it’s now surrounded by many myths. It’s no wonder that people in power are trying to make Flipper Zero illegal. As you might have seen in the news, the Canadian government plans to ban Flipper Zero
866
New Intermediate Certificates
On Wednesday, March 13, 2024, Let’s Encrypt generated 10 new Intermediate CA Key Pairs, and issued 15 new Intermediate CA Certificates containing the new public keys. These new intermediate certificates provide smaller and more efficient certificate chains to Let’s Encrypt Subscribers, enhancing the overall online…
867
Gaining kernel code execution on an MTE-enabled Pixel 8
In this post, I’ll look at CVE-2023-6241, a vulnerability in the Arm Mali GPU that allows a malicious app to gain arbitrary kernel code execution and root on an Android phone. I’ll show how this vulnerability can be exploited even when Memory Tagging Extension (MTE), a powerful mitigation, is enabled on the device.
868
Mintlify GitHub read/write token leak
Edit March 18, 2024 10:20 AM
869
Cloudflare loses 22% of its domains in Freenom .tk shutdown
A staggering 12.6 million domains on TLDs controlled by Freenom (.tk, .cf and .gq) have been shut down and no longer resolve, leading to a significant reduc ...
870
GhostRace: Exploiting and mitigating speculative race conditions
Exploiting and Mitigating Speculative Race Conditions GhostRace: CVE-2024-2193 Race conditions arise when multiple threads attempt to access a shared resource without proper synchronization, often leading to vulnerabilities such as concurrent use-after-free. To mitigate their occurrence, operating systems rely on…