2581
I exploited TLS-SNI-01 issuing Let's Encrypt SSL-certs for any domain (2018)
The original research reports on security issues found in ACME TLS-SNI-01 which caused Let's Encypt to sunset it.
New
The latest blog posts to take off on Hacker News. 4,441 posts.
2582
Steganography Based Ad Payload That Drops Shlayer Trojan on Mac Users
Recent months have seen an uptick in reports of JavaScript malware that hides in image files.
2583
Fearless Security: Memory Safety
Memory safety violations can cause programs to crash unexpectedly and can be exploited to alter intended behavior--languages can manage this multiple ways
2584
2585
2586
Supporters of Mexico’s Soda Tax Targeted with NSO Exploit Links (2017)
An investigation revealing that Mexican soda tax supporters were targeted with NSO Group's government-exclusive spyware and exploit framework.
2587
How to write a rootkit without really trying
We open-sourced a fault injection tool, KRF, that uses kernel-space syscall interception. You can use it today to find faulty assumptions (and resultant bugs) in your programs. Check it out! This post covers intercepting system calls from within the Linux kernel, via a plain old kernel module. We’ll go through a quick…
2588
Oklahoma Department of Securities Leaked Millions of Files
A storage server configured for public access exposed millions of files belonging to the Oklahoma Securities Commission.
2589
2590
2591
Pwn2Own Vancouver 2019: Tesla, VMWare, Microsoft, and more
Starting in 2007, Pwn2Own has evolved from a small demonstration with prizes averaging around $10,000 per exploit, to one of the most well-known security contests in the industry, with millions of dollars of cash and prizes made available to contestants over the years. The contest serves as more tha
2592
2593
Kubernetes Security Best Practices
By Connor Gilbert, product manager at StackRox Last month, the Kubernetes ecosystem was shaken by the discovery of the first major security flaw in Kubernetes, the world’s most popular container…
2594
2595
Metasploit 5.0 Released
We are happy to announce the release of Metasploit 5.0, the culmination of work by the Metasploit team over the past year. Learn more.
2596
No-fly list trial: Court awards fees on government attorneys’ bad faith
Fourteen years to the day after she discovered she was on the no-fly list when she was arrested at SFO, and five years after her legal victory in the first trial of a challenge to a government no-fly order (a Pyrrhic victory as she has still been denied a visa to return to the US), Dr. Rahinah Ibrahim won a third…
2597
2598
Let's Encrypt: Looking Forward to 2019
Let’s Encrypt had a great year in 2018. We’re now serving more than 150 million websites while maintaining a stellar security and compliance track record. Most importantly though, the Web went from 67% encrypted page loads to 77% in 2018, according to statistics from Mozilla. This is an incredible rate of change! We’d…
2599
Fuzzing Like It’s 1989
With 2019 a day away, let’s reflect on the past to see how we can improve. Yes, let’s take a long look back 30 years and reflect on the original fuzzing paper, An Empirical Study of the Reliability of UNIX Utilities, and its 1995 follow-up, Fuzz Revisited, by Barton P. Miller. In this blog post, […]
2600
AdGuard DNS: A Privacy-Oriented DNS Server
AdGuard DNS: a privacy-oriented DNS service that blocks trackers and ads anywhere, from your PC and mobile devices to smart TV and IoT.
2601
2602
Evaluation of five password managers
With an interactive grid to help you pick one!
2603
2604
2605
What We Learned About the Hemisphere Program After Suing the DEA
As the year draws to a close, so has EFF’s long-running Freedom of Information Act lawsuit against the Drug Enforcement Agency about the mass phone surveillance program infamously known as “Hemisphere.” We won our case and freed up tons of records. (So did the Electronic Privacy Information Center...
2606
On VBScript
Posted by Ivan Fratric, Google Project ZeroIntroductionVulnerabilities in the VBScript scripting ...
2607
Download all of your GitHub data
Now you can request an archive of your data from your account settings page.
2608
Let Google do the patching with new managed base images
Exploring container security: Let Google do the patching with new managed base images
2609
2610
Searching statically-linked vulnerable library functions in executable code
Helping researchers find 0ld daysPosted by Thomas Dullien, Project ZeroExecutive summarySoftware ...