2311
Bad Binder: Android In-the-Wild Exploit
Posted by Maddie Stone, Project ZeroIntroductionOn October 3, 2019, we disclosed issue 1942 (CVE-...
New
The latest blog posts to take off on Hacker News. 4,441 posts.
2312
The trouble with VPN and privacy review sites
Evergreen privacy guides, threat modeling, encryption, practical tutorials.
2313
How Cybercriminals Profit by Tapping Your Email
A few days ago I came across the CBC story on how a Canadian man had been defrauded out of $800,000 when cybercriminals inserted themselves into a real estate deal and had the funds diverted to themselves: Here is the "Whois" record for the fake domain used to send the…
2314
Facebook: We don’t need your consent
The world's largest social network believes it has found a way to bypass Europe’s strict privacy laws.
2315
Windows will improve user privacy with DNS over HTTPS
Announcing and explaining our intention to support DNS over HTTPS in future versions of Windows
2316
2317
CVE-2019-1347: When a mouse over a file is enough to crash your system
Advanced security testing platforms for hardware and software investigations. Collaborative tools, proven attack libraries, and expert services for security teams.
2318
We Can Choose an Internet Without Surveillance
The internet is not just a network of computers—it’s a network of people. We hold great power in deciding its future.
2319
Privacy: Is That iPhone?
A new Mozilla-Ipsos poll reveals that a majority of iPhone users treasure privacy — but aren’t aware of the device's ad tracking
2320
Court: Suspicionless Searches of Travelers’ Phones and Laptops Unconstitutional
Government Must Have Reasonable Suspicion of Digital Contraband Before Searching Electronic Devices at the U.S. Border
2321
2322
Security assessment techniques for Go projects
The Trail of Bits Assurance practice has received an influx of Go projects, following the success of our Kubernetes assessment this summer. As a result, we’ve been adapting for Go projects some of the security assessment techniques and tactics we’ve used with other compiled languages. We started by understanding the…
2323
Biometric YubiKey
Learn more about what's happening within the tech and cybersecurity industry and the developments in our business and security keys within our Yubico Blog.
2324
Audio Fingerprinting using the AudioContext API
Audio fingerprinting takes advantage of device performance specs to build up an identifying fingerprint of a user. It uses the AudioContext API for this
2325
Adding Client-Side Scanning Breaks End-to-End Encryption
Recent attacks on encryption have diverged. On the one hand, we’ve seen Attorney General William Barr call for “lawful access” to encrypted communications, using arguments that have barely changed since the 1990’s. But we’ve also seen suggestions from a different set of actors for more purportedly...
2326
SSH Handshake Explained
Secure Shell (SSH) is a widely used Transport Layer Protocol to secure connections between clients and servers. In this post we explain how SSH handshake works.
2327
Chrome 0-day exploit used in Operation WizardOpium
Recently, we caught a new unknown exploit for Chrome browser. After reviewing of the PoC we provided, Google confirmed there was a zero-day vulnerability and assigned it CVE-2019-13720.
2328
DKIM Demystified
DKIM is a way to secure your email, increasing deliverability and avoiding fraud. A 20i Senior Systems Administrator explains DKIM in depth.
2329
Destroying x86_64 instruction decoders with differential fuzzing
TL;DR: x86_64 decoding is hard, and the number and variety of implementations available for it makes it uniquely suited to differential fuzzing. We’re open sourcing mishegos, a differential fuzzer for instruction decoders. You can use it to discover discrepancies in your own decoders and analysis tools! In the…
2330
ProtonMail iOS app goes open source
We have released the Proton Mail iOS app as open source software as part of our commitment to transparency and supporting the developer community.
2331
Xfinity Is Man-in-the-Middle Attacking My Internet
Xfinity injected 581 lines of JavaScript into unencrypted traffic as a data-cap warning, creating MITM risks, accessibility failures, and slower loads.
2332
2333
2334
7M Adobe Creative Cloud Accounts Exposed to the Public
A data exposure of 7 million Adobe Creative Cloud account records could put users at risk of targeted phishing.
2335
Tor Browser 9.0
We want everyone in the world to be able to enjoy the privacy and freedom online Tor provides, and that's why over the past couple years, we've been working hard to boost our UX and localization efforts, with the biggest gains first visible in Tor Browser 8.0. In Tor Browser 9.0, we continue to build upon those…
2336
2337
Get Ready for New SameSite=None; Secure Cookie Settings
UPDATE (10/28/2019): We've revised the 2nd and 3rd bullet points in the section "How to Prepare; Known Complexities" below. In May, Chrome ...
2338
An Intern's Experience with Rust
Over the course of my internship at the Microsoft Security Response Center (MSRC), I worked on the safe systems programming languages (SSPL) team to promote safer languages for systems programming where runtime overhead is important, as outlined in this blog . My job was to port a security critical network processing…
2339
Latest Firefox Brings Privacy Protections Front and Center
Our push this year has been building privacy-centric features in our products that are on by default. With this move, we’re taking the guesswork out of h
2340
