1651
Security issue related to the NPM registry
We're sharing details of recent incidents on the npm registry, our investigations, and how we’re continuing to invest in the security of npm.
New
The latest blog posts to take off on Hacker News. 4,440 posts.
1652
Portugal proposed law tries to sneak in biometric mass surveillance
Whilst the European Parliament has been fighting bravely for the rights of everyone in the EU to exist freely and with dignity in publicly accessible spaces, the government of Portugal is attempting to push their country in the opposite direction: one of digital authoritarianism. The Portuguese lead organisation in…
1653
Blacksmith – Rowhammer bit flips on all DRAM devices today despite mitigations
We demonstrate that it is possible to trigger Rowhammer bit flips on all DRAM devices today despite deployed mitigations on commodity off-the-shelf systems with little effort. This result has a significant impact on the system’s security as DRAM devices in the wild cannot easily be fixed, and previous work showed…
1654
Briar 1.4 – Offline sharing, message transfer via SD cards and USB sticks
Press release The Briar Project released version 1.4 of its Android app today. This release adds a couple of new features, highlighted below. First of all, users can now share the app offline. Prior to this release, the only way to get the app was to to download it from the internet, which requires an internet…
1655
Cloudflare blocks an almost 2 Tbps multi-vector DDoS attack
Earlier this week, Cloudflare automatically detected and mitigated a DDoS attack that peaked just below 2 Tbps — the largest we’ve seen to date.
1656
1657
Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS
Modern web applications typically rely on chains of multiple servers, which forward HTTP requests to one another. The attack surface created by this forwarding is increasingly receiving more attention, including the recent popularisation of cache poisoning...
1658
1659
Proposed illegal image detectors on devices are ‘easily fooled’
Proposed algorithms that detect illegal images on devices can be easily fooled with imperceptible changes to images, Imperial research has found.
1660
The Invisible JavaScript Backdoor
A few months ago we saw a post on the r/programminghorror subreddit: A developer describes the struggle of identifying a syntax error resulting from an invisible Unicode character hidden in JavaScript source code. This post inspired an idea: What if a backdoor literally cannot be seen and thus evades detection even…
1661
Tor Browser 11.0
Tor Browser 11.0 is now available from the Tor Browser download page and our distribution directory. This is the first stable release based on Firefox ESR 91, and includes an important update to Tor 0.4.6.8.
1662
1663
Simple SSH Security
Simple SSH Security Within a couple of minutes you can improve your SSH security significantly.
1664
Six Palestinian organizations hacked with NSO Group’s Pegasus Spyware
On 19 October 2021, Israeli Minister of Defense, Benny Gantz, announced the designation of six leading Palestinian civil society organizations in the Occupied Palestinian Territory as “terrorist organizations” under Israel’s Anti-Terrorism Law 2016. The groups named are Addameer; Al-Haq; Defense for Children …
1665
1666
An opinionated guide on how to reverse engineer software
This is an opinionated guide. After 12 years of reverse engineering professionally, I have developed strong beliefs on how to get good at RE.
1667
Trump’s new social media platform found using Mastodon code
From media reports and individual findings that various people have presented to us, it seems that the new social media platform owned by the former president of the United States, Donald J. Trump, so-called Truth Social, is using Mastodon’s source code with various visual adjustments. The platform has not formally…
1668
Improving first impressions on Signal
The phenomenon of unsolicited and unwanted messaging dates back to the earliest communication platforms: from prehistoric cave graffiti and postal chain letters to popup ads and robocalls. To prevent spam, most online services rely on large-scale inspection of plaintext conversation content or de...
1669
The Patriot Act Has Threatened Freedom for 20 Years
In passing the PATRIOT Act, Congress enacted a “solution” to preventing another 9/11-like debacle without having any evidence that a lack of surveillance powers was what allowed Osama bin Laden’s suicide hijackers to succeed in killing nearly 3,000 Americans.
1670
Encrypting Postgres Data at Rest in Kubernetes
An example of how you can encrypt Postgres data at rest using PGO, the open source Postgres Operator from Crunchy Data using AWS EBS gp2 volumes.
1671
Browser Fingerprinting Without JavaScript
Turning off JavaScript blocks ads but not device tracking. Discover how no-JavaScript fingerprinting works.
1672
Grand jury subpoena for Signal user data, Central District of California
Signal still knows nothing about you, but inexplicably the government continues to ask.
1673
Microsoft has detected nation-state activity associated with NOBELIUM
The Microsoft Threat Intelligence Center (MSTIC) has detected nation-state activity associated with the threat actor tracked as NOBELIUM, attempting to gain access to downstream customers of multiple cloud service providers (CSP), managed service providers (MSP), and other IT services organizations.
1674
Privacy Is a Human Right
Every donation between now and December 31 will be matched, 1:1, by Friends of Tor. Stand up for the human right to privacy and donate to the Tor Project today. Plus… new swag!
1675
NYT journalist hacked with Pegasus after reporting on previous hacking attempts
Our forensic analysis of two iPhones belonging to Hubbard found evidence of Pegasus infections in July 2020 and June 2021. Notably, these infections occurred after Hubbard reported in January 2020 that we found that he was targeted in 2018 by the Saudi Arabia-linked Pegasus operator that we call KINGDOM.
1676
Police can’t demand you reveal your phone passcode then tell a jury you refused
The Utah Supreme Court is the latest stop in EFF’s roving campaign to establish your Fifth Amendment right to refuse to provide your password to law enforcement. Yesterday, along with the ACLU, we filed an amicus brief in State v. Valdez, arguing that the constitutional privilege against self-...
1677
Scientific notation bug in MySQL left AWS WAF vulnerable to SQL injection
We provide around-the-clock threat detection and incident response, backed by expert consulting to keep your organization secure.
1678
Google, Mozilla Close to Finalizing Sanitizer API for Chrome and Firefox Browse
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
1679
Simple Linux kernel memory corruption bug can lead to complete system compromise
An analysis of current and potential kernel security mitigations Posted by Jann Horn, Project ...
1680
Sequoia PGP is now LGPL 2.0
Sequoia is a modular OpenPGP implementation in Rust.