1441
RCE over ham radio – Reverse shell via WinAPRS memory corruption bug
This installment will review and demonstrate functional exploits for WinAPRS on both Windows XP SP3 and Windows 10.
New
The latest blog posts to take off on Hacker News. 4,440 posts.
1442
Dozens of high-traffic websites vulnerable to ‘account pre-hijacking’, study
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
1443
GoodWill ransomware forces victims to donate to the poor
Goodwill ransomware group propagates very unusual demands in exchange for the decryption key. The Robin Hood-like group is forcing its Victims to donate to the poor and provides financial assistance to the patients in need.
1444
NPM security update: Attack campaign using stolen OAuth tokens
npm's impact analysis of the attack campaign using stolen OAuth tokens and additional findings.
1445
Cannoli: The Fast QEMU Tracer
Cannoli Cannoli is a high-performance tracing engine for qemu-user. It can record a trace of both PCs executed as well as memory operations. It consists of a small patch to QEMU to expose locations to inject some code directly into the JIT, a shared library which is loaded
1446
What is end-to-end encryption and how does it work?
End-to-end encryption is the foundation of the Proton ecosystem. Here’s what E2EE means, and how it protects you.
1447
HTTPS Everywhere will sunset in January 2023
You no longer need HTTPS Everywhere to set HTTPS by default! Major browsers now offer native support for an HTTPS only mode. Learn how to turn it on.Read more about the sunset of HTTPS Everywhere.Since we started offering HTTPS Everywhere, the battle to encrypt the web has made leaps and bounds....
1448
Updated Proton, Unified Protection
ProtonMail is now Proton! We’re more than just encrypted email — we now offer an entire privacy-focused ecosystem of services.
1449
Data shows that the EU's CSAM scanning will not have the intended effect
We have analyzed telecommunication surveillance orders. Data shows that the EU's CSAM scanning is completely disproportionate and must be stopped.
1450
Google open sourced PSP (hardware cryptographic offload)
We’re making the PSP Security Protocol for offloading encryption to network interface cards open source today. Here’s why.
1451
Bluetooth relay attacks allow Tesla Model 3 / Y to be unlocked and driven away
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
1452
The end of Roe will bring about a sea change in the encryption debate
With the Supreme Court poised to rip away a constitutional right that’s been the law of the land for nearly half a century by overturning Roe v. Wade, it’s time for the gloves to come off in the encryption debate. For a quarter of a century, it has
1453
Let’s Encrypt Receives the Levchin Prize for Real-World Cryptography
We are honored to be recognized for the impact on the field of cryptography.
1454
Improved Process Isolation in Firefox 100
Firefox uses a multi-process model for additional security and stability while browsing. Web Content is rendered in separate processes.
1455
EU Commission is planning automatic CSAM scanning of private communications
This would be the worst surveillance apparatus outside of China, and completely disproportionate.
1456
Earn $200K by fuzzing for a weekend: Part 1
By applying well-known fuzzing techniques to a popular target, I found several bugs that in total yielded over $200K in bounties. In this article I will demonstrate how powerful fuzzing can be when applied to software which has not yet faced sufficient testing.
1457
Android Chrome 99 expands Certificate Transparency, breaking all MitM dev tools
Certificate transparency is superb improvement to HTTPS certificate security on the web that's great for users and businesses, but on Android it creates a huge...
1458
1459
The Mitto AG surveillanve case – or why we must never backdoor encryption
A single employee leaked sensitive data to secret services, potentially also to Russia.
1460
Yahoo Japan's password-free authentication reduced inquiries, sped up sign-in
Yahoo! JAPAN achieved a passwordless identity system. Learn their approach and the consequences of the effort.
1461
Apple, Google, and Microsoft commit to expanded support for FIDO standard
Faster, easier, and more secure sign-ins will be available to consumers across leading devices and platforms.
1462
1463
Tailscale Authentication for Nginx
Use Tailscale's nginx-auth for secure Single Sign-On (SSO) to internal services, reducing the need for internal account systems.
1464
GitHub will require 2FA by the end of 2023
GitHub will require all users who contribute code on GitHub.com to enable one or more forms of two-factor authentication (2FA) by the end of 2023.
1465
Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard
Faster, easier and more secure sign-ins will be available to consumers across leading devices and platforms
1466
Privacy Friendly Apps – improved privacy protection on the smartphone
We use our smartphone for private conversations, store our contacts and organise our meetings with it. The access to all this sensitive data is handled with the so-called permissions. It means, for example, that each app that requires the smartphone camera needs to get the corresponding permission first. Many of the…
1467
Gnome patent troll stripped of patent rights
A recent decision at the US patent office may well give patent trolls cause to steer clear of open source projects – even more than the fierce resistance the community impressively funded and mount…
1468
Apple’s Private Relay can cause the system to ignore firewall rules
Apple’s Private Relay (Beta) feature calls home to Apple servers without respecting the firewall rules of the system, creating a leak that neither we, nor you, can stop without disabling the entire Private Relay feature.
1469
Internet spring cleaning: How to delete Instagram, Facebook and other accounts
So you’ve washed your sheets and vacuumed under the couch in the name of spring cleaning. But what about your online clutter? Apps that delight, inform a
1470
How SHA-256 Works Step-by-Step
SHA-2 (Secure Hash Algorithm 2), of which SHA-256 is a part, is one of the most popular hash algorithms around. A cryptographic hash, also often referred to as a "digest", "fingerprint" or "signature", is an almost perfectly unique string of characters that is generated from a separate piece of input text. SHA-256…