1921
Uncovering a 24-year-old bug in the Linux Kernel
How a failing rsync run led to the discovery of a long-standing bug in the Linux TCP implementation.
New
The latest blog posts to take off on Hacker News. 4,440 posts.
1922
Preparing to Issue 200M Certificates in 24 Hours
On a normal day Let’s Encrypt issues nearly two million certificates. When we think about what essential infrastructure for the Internet needs to be prepared for though, we’re not thinking about normal days. We want to be prepared to respond as best we can to the most difficult situations that might arise. In some of…
1923
Is Apple Banning Free Analytics SDKs?
This story has moved a lot since it was published – our update from March 3 tells the latest. Apple...
1924
Browser Fuzzing at Mozilla
Mozilla has been fuzzing Firefox for a while. It has proven to be one of the most efficient ways to identify quality and security issues.
1925
What's an SPF Record?
SPF records are DNS records that help prevent SPAM and forged emails
1926
Barcode scanner app on Google Play infects 10M users with one update
In a single update, a popular barcode scanner app that had been on Google Play for years turned into malware.
1927
Android emulator abused to introduce malware onto PCs
Attackers have compromised the software distribution system of BigNox, developer of a popular Android emulator for PCs and Macs.
1928
Clover Health: How Chamath Lured Retail Investors into a Broken Business
Initial Disclosure: This report represents our opinion, and we encourage every reader to do their own due diligence. Please see our full disclaimer at the bottom of the report. We have no position (short or long) in Clover Health because we think in this moment for public markets, it is more important for people to…
1929
1930
Software Verification and Analysis Using Z3
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
1931
Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites (2019)
Dark patterns are user interface design choices that benefit an online service by coercing, steering, or deceiving users into making unintended and potentially harmful decisions. We conducted a large-scale study, analyzing ~53K product pages from ~11K shopping websites to characterize and quantify the prevalence of…
1932
The censorship of WallStreetBets needs to be a watershed moment for everyone
This event is when censorship overstepped a very serious mark.
1933
A Look at iMessage in iOS 14
Posted By Samuel Groß, Project Zero On December 20, Citizenlab published “The Great...
1934
EU citizens’ rights are under threat from anti-encryption proposals
Along with Threema, Tresorit, and Tutanota, we are releasing a joint statement calling on the EU to reject any ban or attack on end-to-end encryption.
1935
Opening Up the Samsung Q60 Series Smart TV (2019)
True cyber security combines advanced technology and best practice. Get tips and read articles on how to take your online security even further.
1936
1937
Firefox 85 cracks down on supercookies
Trackers and adtech companies have long abused browser features to follow people around the web. Since 2018, we have been dedicated to reducing the number of ways our users can ...
1938
Grindr to be fined almost €10M over GDPR complaint
The Norwegian Data Protection Authority confirmed that Grindr did not receive valid consent from users and announces a fine of 100 Mio NOK (€ 9.63 Mio) on Grindr.
1939
New campaign targeting security researchers
Details on an ongoing campaign, which we attribute to a government-backed entity based in North Korea, targeting security researchers working on vulnerability research a…
1940
A deeper dive into our May 2019 security incident
We take a detailed look at a hacking incident that gave a user unauthorized access to our code and data.
1941
Emails a browser extension developer gets from scammers
SponsorBlock is a crowdsourced browser extension to skip sponsor segments in YouTube videos.
1942
Access Control for GitHub Pages
GitHub Pages now gives you the option to limit access, making the site visible only to users with access to the repository that published the Page. With access control, you…
1943
The database servers powering Let's Encrypt
Let’s Encrypt helps to protect a huge portion of the Web by providing TLS certificates to more than 235 million websites. A database is at the heart of how Let’s Encrypt manages certificate issuance. If this database isn’t performing well enough, it can cause API errors and timeouts for our subscribers. Database…
1944
The State of State Machines
Posted by Natalie Silvanovich, Project ZeroOn January 29, 2019, a serious vulnerability was ...
1945
Yubico proposes WebAuthn protocol extension to simplify backup security keys
Yubico proposes a new WebAuthn extension to the World Wide Web Consortium (W3C) to add a user-friendly solution for backup security keys, and receives cryptographic proof from researchers at the Surrey Center for Cyber Security.
1946
BitLocker Lockscreen Bypass
BitLocker is a modern data protection feature that is deeply integrated in the Windows kernel. It is used by many corporations as a means of protecting company secrets in case of theft. Microsoft recommends that you have a Trusted Platform Module which can do some of the heavy cryptographic lifting for you.
1947
Limiting Private API Availability in Chromium
During a recent audit, we discovered that some third-party Chromium based browsers were able to integrate Google features, such as Chrome sy...
1948
Escaping VirtualBox 6.1: Part 1
This post is about a VirtualBox escape for the latest currently available version (VirtualBox 6.1.16 on Windows). The vulnerabilities were discovered and exploited by our team Sauercl0ud as part of the RealWorld CTF 2020/2021. The vulnerability was known to the organizers, requires the guest to be able to insert…
1949
1950
How I hijacked the top-level domain of a sovereign state
Here’s how I temporarily took over 50% of all DNS traffic for the TLD of the Democratic Republic of Congo.