The latest blog posts to take off on Hacker News. 317 posts.
Our exploration begins with an honest appraisal of traditional fuzzing methodologies that have been applied to TCP/IP stacks before, like ISIC, revealing their inherent limitations, e.g., they can't reach beyond the TCP initial state. Recognizing the need for a more evolved approach, we take a different approach…
Kaspersky’s Global Research and Analysis Team (GReAT) has unveiled a previously unknown hardware feature in Apple iPhones, pivotal to the Operation Triangulation campaign. The team presented this discovery at the 37th Chaos Communication Congress in Hamburg.
Recent iPhone models have additional hardware-based security protection for sensitive regions of the kernel memory. We discovered that to bypass this hardware-based security protection, the attackers used another hardware feature of Apple-designed SoCs.
Introduction # The Tillitis TKey is a small computer in a USB stick form factor that can run small device applications that are loaded onto it. The purpose of the TKey is to be a secure environment for applications that provide some kind of security function. Some examples of such security functions are: Time-based…
Google has rolled out "Privacy Sandbox," a Chrome feature first announced back in 2019 that, among other things, exchanges third-party cookies—the most common form of tracking technology—for what the company is now calling "Topics." Topics is a response to pushback against Google’s proposed...
Introducing a novel technique for e-mail spoofing
Today I’m publicizing a Google OAuth vulnerability that allows employees at companies to retain indefinite access to applications like Slack and Zoom, after they’re off-boarded and removed from their company’s Google organization. The vulnerability is easy for a non-technical audience to understand and exploit.
Panoptica by Outshift delivers advanced cloud-native security insights to help teams protect modern applications and infrastructure at scale.
Ten years ago, Edward Snowden shared documents with the press that exposed the extent of the U.S. government’s mass surveillance program – and used Tor to protect himself while doing so. How has the perception of privacy changed since then, and what are the Tor Project’s challenges for the year to come?
Authors: PromptArmor and Kai Greshake
Over the past year, the MORSE team has been working in collaboration with the Windows Print team to modernize the Windows Print System. This new design,...
Just as Vulnerability Research is an important area of focus at Google, so is Vulnerability Response to critical and complex vulnerabilities. Vulnerability Response at Google not only helps secure Google’s products and users, but in certain cases, it affects millions of devices across the Internet. In this post, we'll…
Posted by Ivan Lozano and Roger Piqueras Jover Android’s defense-in-depth strategy applies not only to the Android OS running on the Appl...
FISA Reform §702 Is a Threat to Democracy At Home and Abroad.
Two bills reauthorizing Section 702 of the Foreign Intelligence Surveillance Act are headed to the House floor. Meanwhile, FBI agents have used Section 702 databases to conduct millions of invasive searches for Americans’ communications, including those of protesters, racial justice activists, 19,000 donors to a…
Yesterday the House Permanent Select Committee on Intelligence unanimously approved the FISA Reform and Reauthorization Act of 2023 (FRRA), which would reauthorize Section 702 of the Foreign Intelligence Surveillance Act (FISA 702). The full House is expected to vote on this bill next Tuesday. Like other competing…
Akamai researchers discovered a new set of attacks against Active Directory (AD) using Microsoft DHCP servers that can lead to full AD takeover.
We're here to stop surveillance by corporations like Google and Apple. That's why we replaced Google's FCM with our own notification system and keep Apple Notification Data at a minimum. Learn here why this is important.
Meta AI announces Purple Llama, a project for open trust and safety in generative AI, with tools for cybersecurity and input/output filtering.
We are beginning to upgrade people’s personal conversations on Messenger to use end-to-end encryption (E2EE) by default. Meta is publishing two technical white papers on end-to-end encryption: Our …
Update: Emails from Tutanota.com no longer go to Spam in Outlook.
LogoFAIL by BINARLY: Discover how vulnerable image parsing impacts device manufacturers in the UEFI firmware ecosystem. Learn about critical LogoFAIL…
U.S. Senator Ed Markey of Massachusetts has sent a much-needed letter to car manufacturers asking them to clarify a surprisingly hard question to answer: what data cars collect? Who has the ability to access that data? Private companies can often be a black box of secrecy that obscure basic facts...
This marks a positive development for human rights in one of the most controversial draft European Union (EU) laws in recent memory.
Meta charges up to €251.88 to respect the fundamental right to privacy of EU users. This is a violation of the GDPR
When it comes to most secure browsers, Firefox and its LibreWolf fork are the best alternatives to Chrome on our list - and, no, incognito mode doesn't cut it.
If someone calls you claiming to be from Monzo, you can now check to see if they’re telling the truth or not in the Monzo app.
