1621
Widespread exploitation of critical remote code execution in Apache Log4j
On December 10, 2021, Apache released a fix for CVE-2021-44228, a critical RCE vulnerability affecting Log4j that is being exploited in the wild.
New
The latest blog posts to take off on Hacker News. 4,440 posts.
1622
0-Day Vulnerability on Log4j
Learn about the Log4j vulnerability and how you can combat it. Read this comprehensive guide to get actionable tips.
1623
1624
Chrome users beware: Manifest v3 is deceitful and threatening
Like FLoC and Privacy Sandbox before it, Google Chrome’s Manifest V3 is another example of the inherent conflict of interest that comes from Google controlling both the dominant web browser and one of the largest internet advertising networks.
1625
Protected Content, Delete by Date, Device Management and more
Today's update brings tools to prevent others from saving content from groups and channels, the ability to delete messages for specific periods of time, new ways to manage your connected devices, post anonymously in public groups on behalf of your channel and more.
1626
Windows 10 RCE: The exploit is in the link
Chaining a misconfiguration in IE11/Edge Legacy with an argument injection in a Windows 10/11 default URI handler and a bypass for a previous Electron patch, we developed a drive-by RCE exploit for Windows 10. The main vulnerability in the ms-officecmd URI handler has not been patched yet and can also be triggered…
1627
uBlock, I exfiltrate: exploiting ad blockers with CSS
Ad blockers like uBlock Origin are extremely popular, and typically have access to every page a user visits. Behind the scenes, they're powered by community-provided filter lists - CSS selectors that
1628
WebAssembly and Back Again: Fine-Grained Sandboxing in Firefox 95
In Firefox 95, we're shipping a sandboxing technology called RLBox — developed with researchers at UC San Diego and the University of Texas
1629
Digging into Linux namespaces – part 1
Process isolation is a key component for containers. One of the key underlying mechanisms are namespaces. We will explore what they are, and how they work, to build our own isolated container and better understand each piece.
1630
Germany: New government plans 'right to encryption'
The coalition contract of the newly elected German government contains right to encryption.
1631
Microsoft Windows RCE Vulnerability Gives an Attacker Complete Control
Synack Red Team breaks down a Windows RCE vulnerability enabling full remote code execution and complete attacker control — exploitation techniques and real-world security analysis.
1632
Chrome phasing out Manifest v2 support from Jan 2022
Details of the Manifest V2 phase-out and end of life.
1633
This shouldn't have happened: A vulnerability postmortem
Posted by Tavis Ormandy, Project Zero Introduction This is an unusual blog post. I normally wri...
1634
Texas woman wins round in lawsuit challenging swat teams destruction of her home
ARLINGTON, Va.—On Thursday, a federal judge ruled that a lawsuit filed by a Texas woman whose home was destroyed by a SWAT team may move […]
1635
An Illustrated Guide to Elliptic Curve Cryptography Validation
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
1636
The case of the recursive resolvers: What happened during Slack’s DNSSEC rollout
On September 30th 2021, Slack had an outage that impacted less than 1% of our online user base, and lasted for 24 hours. This outage was the result of our attempt to enable DNSSEC — an extension intended to secure the DNS protocol, required for FedRAMP Moderate — but which ultimately led to a series of…
1637
Vulnerabilities in chips in 37% of smartphones
Highlights Check Point Research discovered vulnerabilities in MediaTek’s chips, embedded in 37% of all smartphones globally CPR discovered several %
1638
New differential fuzzing tool reveals novel HTTP request smuggling techniques
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
1639
New German government calls for European ban on biometric mass surveillance
The newly-agreed German government coalition has called for a Europe-wide ban on public facial recognition and other biometric surveillance. This echoes the core demands of the Reclaim Your Face campaign which EDRi has co-led since 2020, through which over 65 civil society groups ask the EU and their national…
1640
1641
Apple sues NSO Group to curb the abuse of state-sponsored spyware
Apple today filed a lawsuit against NSO Group to hold it accountable for abusive surveillance and the targeting of a small number of Apple users.
1642
SugarCoat: Private browsing without breaking the web
A team of computer scientists at the University of California San Diego and Brave Software. have developed a tool that will increase protections for users’ private data while they browse the web.
1643
1644
Fingerprints can be hacked
Fingerprint authentication is a convenient alternative to passwords and PIN codes. Who wants to spend time typing in a lengthy string of numbers, letters and characters when a simple tap will suffice? Unfortunately, that convenience comes at a cost. Because, unlike a regular password, you leave your fingerprint on…
1645
What every IT person needs to know about OpenBSD Part 3: That packet filter
Useful and fun features related to the OpenBSD packet filter.
1646
ChaosDB Explained: Azure's Cosmos DB Vulnerability Walkthrough
This is the full story of the Azure ChaosDB Vulnerability that was discovered and disclosed by the Wiz Research Team, where we were able to gain complete unrestricted access to the databases of several thousand Microsoft Azure customers.
1647
How we protect our most sensitive secrets from the most determined attackers
As a bank, we have a lot of secrets we need to protect to keep our customers and ourselves safe. These include private keys that only we know, which we use to digitally sign requests as coming from us (sort of like a private password). These private keys are super important and are used all over Monzo and when…
1648
Dangerous bug in Chrome’s ‘New Tab’ page bypassed security features
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
1649
TPM Sniffing
TL;DR : we reproduced Denis Andzakovic’s proof-of-concept showing that it is possible to read and write data from a BitLocker-protected device (for instance, a stolen laptop) by sniffing the TPM key from the LCP bus.
1650
New and improved Linux Random Number Generator ready for testing
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.