1201
Belgium launches nationwide safe harbor for ethical hackers
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
New
The latest blog posts to take off on Hacker News. 4,440 posts.
1202
Germany opposes EU plans for client-side scanning
Germany opposes client-side scanning planned by EU - it would create an unprecedented surveillance monster that violates fundamental rights.
1203
First in-the-wild UEFI bootkit bypassing UEFI Secure Boot
ESET researchers are the first to publish an analysis of BlackLotus, the first in-the-wild UEFI bootkit capable of bypassing UEFI Secure Boot.
1204
1205
We will not ‘walk out’ of UK, nor comply with any request to bypass encryption
Tutanota: We will not 'walk out' of UK like Signal. Nor will we comply with any request to bypass our encryption.
1206
1207
How to weaponize the Yubikey (2019)
Michael Allen // A couple of years ago, I had a YubiKey that was affected by a security vulnerability, and to fix the issue, Yubico sent me a brand new […]
1208
A tale of Phobos – How we almost cracked a ransomware using CUDA
For the past two years we've been tinkering with a proof-of-concept decryptor for the Phobos family ransomware. It works, but is impractical to use for reasons we'll explain here. Consequently, we've been unable to use it to help a real-world victim so far. We've decided to publish our findings and tools, in hope that…
1209
1210
FCC Considering Banning Transfer of Online Consent Forms
Editor’s note: this version was updated at 6:00 pm pacific to include a couple of paragraphs that were omitted from the original post. Also–HI to all the thousands of regular people coming to visit today. I get it–we ALL hate unwanted calls and texts. But destroying the infrastructure of connecting consumers with…
1211
Security audit of account and payment services
Assured AB were contracted to perform a security assessment of our account and payment services between 2022-11-07 and 2022-11-29.
1212
Valve bans 40k Dota 2 accounts using honeypot patch
Today, we permanently banned over 40,000 accounts that were using third-party software to cheat in Dota over the last few weeks. This software was able to access information used internally by the Dota client that wasn't visible during normal gameplay, giving the cheater an unfair advantage. While fixing the…
1213
Mozilla solves the Manifest V3 puzzle to save ad blockers
Google Chrome's new platform for extensions, Manifest V3, threatens to limit the functionality of ad blockers. Firefox has found a way around this problem. Read how.
1214
Unpacking the Benefits of Zero Trust Architecture as Defined by NIST
NIST has released a draft of SP 1800-35 , Implementing a Zero Trust Architecture. The lengthy documents lay out their definition of Zero Trust Architecture (ZTA) , the benefits, why it’s important, a few examples of how an organization can implement them, expected results associated with their example builds, and a…
1215
1216
Curl audit: How a joke led to significant findings
In fall 2022, Trail of Bits audited cURL, a widely-used command-line utility that transfers data between a server and supports various protocols. The project coincided with a Trail of Bits maker week, which meant that we had more manpower than we usually do, allowing us to take a nonstandard approach to the […]
1217
Cloudflare mitigates record-breaking 71M request-per-second DDoS attack
This was a weekend of record-breaking DDoS attacks. Over the weekend, Cloudflare detected and mitigated dozens of hyper-volumetric DDoS attacks. The majority of attacks peaked in the ballpark of 50-70 million requests per second (rps) with the largest exceeding 71 million rps
1218
How to get a heart attack while using JEB decompiler (2022)
Finding RCE during deobfuscation in JEB decompiler running on Java 18.
1219
1220
The Online Safety Bill: An attack on encryption
The Online Safety Bill has some genuinely good intentions, but the proposed legislation is remarkably poor.
1221
OpenSSH Pre-Auth Double Free – Writeup and Proof-of-Concept
Understanding the OpenSSH CVE-2023-25136 high vulnerability. Read our analysis with Proof-of-Concept, learn what's vulnerable, and discover remediations.
1222
1223
Stop the proposal on mass surveillance of the EU
The European Commission is currently in the process of enacting a law called Chat control. If the law goes into effect, it will mean that all EU citizens' communications will be monitored and listened to.
1224
Google's OSS-Fuzz expands fuzz-reward program
Posted by Oliver Chang, OSS-Fuzz team Since launching in 2016 , Google's free OSS-Fuzz code testing service has helped get over 8800 vul...
1225
Ronin 2.0 – open-source Ruby toolkit for security research and development
After nearly a full year of non-stop development since the initial announcement of The Big Refactor , 4153 commits made, 700 issues closed , and a month of beta testing, Ronin 2.0.0 has finally been released!
1226
Data-Free Disneyland
(Note: This is the companion post to my article at Public Books about evading data detection at Disneyland. For the…
1227
EU chat control law will ban open source operating systems
Update: Open source OSes might be saved from being covered depending on the interpretation of EU regulation 2019/1150 2.2.c.
1228
Modernizing C arrays for greater memory safety: a case study in the Linux kernel
How to modernize C arrays for greater memory safety: a case-study in refactoring the Linux kernel and a look to the future Kees Cook C i...
1229
UK Online Safety Bill threatens encryption, secure communication, and reporting
Does the image above, depicting the rescue of a child who attempted to reach the U.K. by sea, present the act of immigration in “a positive light”? It’s an absurd question, of course. It’s journalism – an effort to convey in visual terms the stark truth that tens of thousands of migrants and asylum-seekers try to…
1230
An investigation into Apple’s new Relay network
Guest Post: Analysing Apple Private Relay’s effects on the Internet and future measurement-based research.