1
Colliding with the SHA prefix of Linux's initial Git commit
Or, how to break all the tools that parse the "Fixes:" tag Kees Cook There was a recent discussion about how Linux's "Fixes" tag, which ...
New
The latest blog posts to take off on Hacker News. 257 posts.
2
3
Fighting spam with Haskell at Meta (2015)
Visit the post for more.
4
Alignment faking in large language models
A paper from Anthropic's Alignment Science team on Alignment Faking in AI large language models
5
Scanners Beware: Welcome to the network from hell
We’ve crafted a bold defense strategy that not only slows scans but actively disrupts and deceives attackers.
6
7
Clio: A system for privacy-preserving insights into real-world AI use
Anthropic's new system, Clio, analyzes how people use AI while maintaining their privacy.
8
Review of Mullvad VPN
X41 releases the audit report of Mullvad VPN
9
10
Compromising OpenWrt Supply Chain
Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc. A few days ago, I was upgrading my home lab network, and I decided to upgrade the OpenWrt on my router.1 After accessing the LuCI, which is the web interface of OpenWrt, I noticed that there is a section called Attended Sysupgrade…
11
OpenAI o1 system card
This report outlines the safety work carried out prior to releasing OpenAI o1 and o1-mini, including external red teaming and frontier risk evaluations according to our Preparedness Framework.
12
Bootkitty: Analyzing the first UEFI bootkit for Linux
ESET's discovery of the first UEFI bootkit designed for Linux sendss an important message: UEFI bootkits are no longer confined to Windows systems alone.
13
Do you need ID to read the REAL-ID rules?
[“The welcoming, friendly and visually pleasing appearance” of the TSA’s headquarters at 6595 Springfield Center Drive, Springfield, VA.]
14
Judge's Investigation into Patent Troll Results in Criminal Referrals
In 2022, three companies with strange names and no clear business purpose beyond patent litigation filed dozens of lawsuits in Delaware federal court, accusing businesses of all sizes of patent infringement. Some of these complaints claimed patent rights over basic aspects of modern life; one, for...
15
Wildlife monitoring technologies used to intimidate and spy on women
Camera traps and drones deployed by government authorities to monitor a forest in India are infringing on the privacy and rights of local women.
16
The Nearest Neighbor Attack
In early February 2022, notably just ahead of the Russian invasion of Ukraine, Volexity made a discovery that led to one of the most fascinating and complex incident investigations Volexity had ever worked. The investigation began when an alert from a custom detection signature Volexity had deployed at a customer site…
17
Security researchers identify new malware targeting Linux
ESET researchers analyzed previously unknown Linux backdoors that are connected to known Windows malware used by the China-aligned Gelsemium group, as well as to Project Wood.
18
Listen to the whispers: web timing attacks that work
Websites are riddled with timing oracles eager to divulge their innermost secrets. It's time we started listening to them. In this paper, I'll unleash novel attack concepts to coax out server secrets
19
Let's Encrypt is 10 years old now
Vital personal and business information flows over the Internet more frequently than ever, and we don’t always know when it’s happening. It’s clear at this point that encrypting is something all of us should be doing. Then why don’t we use TLS (the successor to SSL) everywhere? Every browser in every device supports…
20
DNA testing company vanishes along with its customers' genetic data
Atlas Biomed, a DNA testing company that promised clients insights into their genetic disposition has suddenly disappeared.
21
Are We PEP740 Yet?
PEP 740 is a Python standard for defining cryptographically verifiable attestations hosted by indices like PyPI.
22
PyPI now supports digital attestations
Announcing support for PEP 740 on the Python Package Index
23
A memory leak in Apple's Network Extension framework
Is it normal for the Little Snitch Network Extension to consume Gigabytes of memory? No it isn’t. Unfortunately that’s another new bug in the Network Extension framework of macOS. It’s a memory leak in Apple’s framework, which developers…
24
25
The Beginner's Guide to Visual Prompt Injections (2023)
Learn about visual prompt injections, their appearance, and top defense strategies against these attacks.
26
Abusing Ubuntu 24.04 features for root privilege escalation
With the recent release of Ubuntu 24.04, we at Snyk Security Labs thought it would be interesting to examine the latest version of this Linux distribution to see if we could find any interesting privilege escalation vulnerabilities.
27
Early Cascade Injection: From Windows process creation to stealthy injection
Get an introdcution to Early Cascade, a novel process injection technique that is effective against top tier EDRs while avoiding detection.
28
Hyperlight: Virtual machine-based security for functions at scale
The Microsoft Azure Core Upstream team is excited to announce the Hyperlight project, an open-source Rust library you can use to create very small VMs for embedded functions. Learn more.
29
Combining Machine Learning and Homomorphic Encryption in the Apple Ecosystem
At Apple, we believe privacy is a fundamental human right. Our work to protect user privacy is informed by a set of privacy principles, and…
30
Using Large Language Models to Catch Vulnerabilities
Posted by the Big Sleep team Introduction In our previous post, Project Naptime: Evaluating Offe...