1051
Why we don’t generate elliptic curves every day
Elliptic curves are standardized, instead of being generated like Diffie-Hellman parameters. There's good reasons!
New
The latest blog posts to take off on Hacker News. 4,333 posts.
1052
1053
Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App
How an open redirect in Harvest’s Outlook Calendar integration leaked the OAuth tokens of connected Microsoft accounts, with a step-by-step proof of concept.
1054
Mitigating the Hetzner/Linode XMPP.ru MitM interception incident
(If you just want some recommendations for what to do, skip down to the Recommendations section below .)
1055
Hackers stole access tokens from Okta's support unit
Okta , a company that provides identity tools like multi-factor authentication and single sign-on to thousands of businesses, has suffered a security breach involving a compromise of its customer support unit, KrebsOnSecurity has learned. Okta says the incident affected a “very small number” of customers, however it…
1056
EU Commissioner as double agent of foreign interference
Research published yesterday by several European media outlets has revealed that an international campaign in support of the EU's proposed child sexual abuse regulation has been largely orchestrated and financed by a network of organisations with links to the tech industry and security services. The
1057
"<ESC>[31M"? ANSI Terminal security in 2023 and finding 10 CVEs
This paper reflects work done in late 2022 and 2023 to audit for vulnerabilities in terminal emulators, with a focus on open source software. The results of this work were 10 CVEs against terminal emulators that could result in Remote Code Execution (RCE), in addition various other bugs and hardening opportunities…
1058
Encrypted traffic interception on Hetzner and Linode targeting Jabber service
TL;DR: we have discovered XMPP (Jabber) instant messaging protocol encrypted TLS connection wiretapping (Man-in-the-Middle attack) of jabber.ru (aka xmpp.ru) service’s servers on Hetzner and Linode hosting providers in Germany. The attacker has issued several new TLS certificates using Let’s Encrypt service which were…
1059
1060
The fake browser update scam gets a makeover
One of the oldest malware tricks in the book — hacked websites claiming visitors need to update their Web browser before they can view any content — has roared back to life in the past few months. New research shows the attackers behind one such scheme have developed an ingenious way of keeping their malware from…
1061
Tech CEO sentenced to 5 years in IP address scheme
Amir Golestan , the 40-year-old CEO of the Charleston, S.C. based technology company Micfo LLC , has been sentenced to five years in prison for wire fraud. Golestan’s sentencing comes nearly two years after he pleaded guilty to using an elaborate network of phony companies to secure more than 735,000 Internet Protocol…
1062
1063
Encrypting private data and private communications is now an ethical duty
We have come to a point where end-to-end encrypting all your private data and private communications
1064
Undermining Democracy: The EU Commission's Controversial Push for Surveillance
The European Commission wants to turn digital communication apps, such as WhatsApp, iMessage, Instagram, TikTok and X, into mass surveillance tools so that digital communications of all EU citizens, including their live conversations, photos and videos, can be automatically scanned for criminal offences.[1] Even of…
1065
Multi-modal prompt injection image attacks against GPT-4V
GPT4-V is the new mode of GPT-4 that allows you to upload images as part of your conversations. It’s absolutely brilliant. It also provides a whole new set of vectors …
1066
We Were Wrong About the GPLs
an unsurprising admission in Conservancy v. Vizio
1067
Chat Control 2.0: EU set to approve end of private messaging, secure encryption
By making a minor concession EU governments hope to find a majority next week to approve the controversial „chat control“ bill. According to the proposed child sexual abuse regulation (CSAR), providers of messengers, e-mail and chat services would be forced to automatically search all private messag
1068
Tainting the CSAM client-side scanning database
The proposal of the European Commission for a regulation on preventing and combatting the sexual abuse and sexual exploitation of children is currently discussed in Dutch parliament. I recently wrote about some concerns and the risk of a DDoS attack . It turns out it is also possible to taint the database of images of…
1069
1070
Bounty to Recover NIST's Elliptic Curve Seeds
This is a fun challenge: The NIST elliptic curves that power much of modern cryptography were generated in the late ’90s by hashing seeds provided by the NSA. How were the seeds generated? Rumor has it that they are in turn hashes of English sentences, but the person who picked them, Dr. Jerry Solinas, passed away in…
1071
Cisco can't stop using hard-coded passwords
There’s a new Cisco vulnerability in its Emergency Responder product: This vulnerability is due to the presence of static user credentials for the root account that are typically reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A…
1072
EU "Chat Control" and Mandatory Client Side Scanning
On the 11th of October, Dutch parliament organized a hearing on the EU “Chatcontrol” proposal, with a focus on client side scanning. Dutch parliament had earlier passed two motions calling on the Dutch government not to support this proposal, but our government has declared it will ignore those motions. This hearing…
1073
How I Made a Heap Overflow in Curl
In association with the release of curl 8.4.0, we publish a security advisory and all the details for CVE-2023-38545. This problem is the worst security problem found in curl in a long time. We set it to severity HIGH. While the advisory contains all the necessary details. I figured I would use a few additional ……
1074
Reversing 'France Identité': The New French Digital ID
-------------- Update from 06/10/2023 : following my publication, I’ve been in contact with France Identité CISO and they could provide mo...
1075
NIST Elliptic Curves Seeds Bounty
Announcing a $12,288 bounty (tripled to charity) for cracking the five seeds selected by the NSA in the '90s for the NIST elliptic curve standard.
1076
Python 3.12.0 from a supply chain security perspective
This critical role would not be possible without funding from the OpenSSF Alpha-Omega Project. Massive thank-you to Alpha-Omega for investing in the security of the Python ecosystem! Python ...
1077
Debunking NIST's calculation of the Kyber-512 security level
[Sidney Harris cartoon used with permission. Copyright holder: ScienceCartoonsPlus.com .]
1078
root with a single command: sudo logrotate
Starting from the constraint that only sudo logrotate * may be run, and ending at root: abusing the log file flag to overwrite root owned scripts and ride cron to privilege escalation.
1079
Exploiting the iPhone 4
Years ago, I was active in the iOS tweak development scene. I made many products and tools, distributed on Cydia, that modified iOS system behavior and added new functionality to SpringBoard. This was a really fun time, and gave me valuable early career exposure to reverse engineering closed-source binaries…
1080