2221
Using BPF to Transform SSH Sessions into Structured Events
Teleport’s Enhanced Session Recording feature can add vital extra visibility into commands being run on your systems.
New
The latest blog posts to take off on Hacker News. 4,441 posts.
2222
Let's Encrypt Has Issued a Billion Certificates
We issued our billionth certificate on February 27, 2020. We’re going to use this big round number as an opportunity to reflect on what has changed for us, and for the Internet, leading up to this event. In particular, we want to talk about what has happened since the last time we talked about a big round number of…
2223
Kr00k vuln in WiFi chips that allows unauthorized decryption of traffic
Kr00k – formally known as CVE-2019-15126 – is a vulnerability in Broadcom and Cypress Wi-Fi chips that allows unauthorized decryption of some WPA2-encrypted traffic.
2224
DOJ plans to strike against encryption while the Techlash iron is hot
There’s a story in today’s Washington Post “Cybersecurity 202” newsletter that confirms that the Department of Justice is capitalizing on the techlash in order to build up congressional support for the DOJ’s long-desired goal of legislation that will restrict your freedom to encrypt your data and
2225
Securing Firefox with WebAssembly
Protecting the security and privacy of individuals is a central tenet of Mozilla’s mission. While we continue to make extensive use of both sandboxing and Rust in Firefox to address ...
2226
Firefox turns on DoH as default for US users
Today, Firefox began the rollout of encrypted DNS over HTTPS (DoH) by default for US-based users. The rollout will continue over the next few weeks to conf
2227
Mozilla’s DNS over HTTPs
The current insecure DNS system leaves billions of people around the world vulnerable because the data about where they go on the internet is unencrypted. We’ve set out to change ...
2228
FIDO2 security key company publishes results of internal security audit
This blogpost summarizes the result of a cooperation between SoloKeys and Doyensec, and was originally published on SoloKeys blog by Emanuele Cesena. You can...
2229
2230
Multi-Perspective Validation Improves Domain Validation Security
At Let’s Encrypt we’re always looking for ways to improve the security and integrity of the Web PKI. We’re proud to launch multi-perspective domain validation today because we believe it’s an important step forward for the domain validation process. To our knowledge we are the first CA to deploy multi-perspective…
2231
Sealed Rust Update
Part 2 - The Plan
2232
Open Source Security Tools
Explore open source cloud security tools that help teams improve visibility, automate detections, and strengthen modern cloud-native security operations workflows.
2233
Mitigations are attack surface, too
Posted by Jann Horn, Project ZeroIntroductionThis blog post discusses a bug leading to memory cor...
2234
Multi-account containers add-on sync feature
The Multi-Account Containers Add-on will now sync your container configuration and site assignments. Firefox Multi-Account Containers allows users to separate their online identities into different tab types called Containers. Each ...
2235
Several months in the life of Project Zero – Part 1: The Chrome bug of suffering
Posted by Sergei Glazunov and Mark Brand, Project ZeroIntroductionIt was a normal week in the Pro...
2236
2237
Critical Bluetooth vulnerability in Android
On November 3rd, 2019, we have reported a critical vulnerability affecting the Android Bluetooth subsystem. This vulnerability has been assigned CVE-2020-0022 and was now patched in the latest security patch from February 2020. The security impact is as follows:
2238
Zero-days in Cisco Discovery Protocol
Identify which devices of your company are impacted by five vulnerabilities that Armis found out in the Cisco Discovery Protocol (CPD).
2239
Mental health websites don't have to sell user data but most still do
The changes discussed in this article are based on a second analysis performed in late November, 3 months after the original study Your Mental Health is for Sale and following the exact same methodology.
2240
2241
Using ‘radioactive data’ to detect if a data set was used for training
Facebook AI has developed a new technique to mark the images in a dataset, so that researchers can then determine if a particular machine learning model...
2242
Website data leaks pose greater risks than most people realize
Students find website data leaks pose greater risks than most people realize
2243
2244
Swift Crypto
I’m thrilled to announce a new open-source project for the Swift ecosystem, Swift Crypto. Swift Crypto is a new Swift package that brings the fantastic APIs of Apple CryptoKit to the wider Swift community. This will allow Swift developers, regardless of the platform on which they deploy their applications, to access…
2245
TeamViewer stores user passwords in registry, encrypted with hard-coded key
Oh man where to even begin with this one. This was a crazy ride and I learned a ton along the way.
2246
Buffer overflow when pwfeedback is set in sudoers
Sudo’s pwfeedback option can be used to provide visual feedback when the user is inputting their password. For each key press, an asterisk is printed. This option was added in response to user confusion over how the standard Password: prompt disables the echoing of key presses. While pwfeedback is not enabled by…
2247
Writing Safe Shell Scripts (2019)
This page was migrated from the old website and has not been manually reviewed, or is here for historical purposes. We make no guarantees that the content is up-to-date or reflects SIPB's current views. Contact sipb-www@mit.edu if anything is broken or you have other questions or feedback.
2248
ACLU: ICE and CBP Are Secretly Tracking Us Using Stingrays. We’re Suing
The public has a right to know if and how often ICE and CBP are using Stingrays.
2249
New Cryptographic Tools on Keybase
You're reading the Keybase blog. There are more posts . When you're done, you can install Keybase .
2250
Critical flaw in Trezor hardware wallets
Kraken Security Labs has devised a way to extract seeds from both cryptocurrency hardware wallets offered from industry leader Trezor, the Trezor One and Trezor Model T. The attack requires just 15 minutes of physical access to the device. This is the first time that the detailed steps for a current attack against…