1081
The presumption that computers are working correctly
The first in a series of posts on the Post Office Horizon prosecutions scandal
New
The latest blog posts to take off on Hacker News. 4,333 posts.
1082
Why are websites requesting access to motion sensors on my desktop? (2019)
I was checking the status of a FedEx order when Brave warned me that “this site has been blocked from accessing your motion sensors”. I’m struggling to understand why a website would need that access. Do I get a different experience if I drop my device? Tip my monitor over? Spin the mouse around?
1083
A gentle introduction to static analyzers for C
One of the great thing about C are the many fairly mature tools in the ecosystem. The bad news however is that most educational materials don't teach them and thus many beginners (and sometimes even experienced) developers have absolutely no awareness that these tools even exists.
1084
Introduction to sysclean(8)
sysclean(8) is a system tool designed for help system administrator to keep their OpenBSD clean after upgrade.
1085
Tempest: Transmit Radio Waves via a PC Video Card with No Extra Hardware
the quality of the music is not exactly what you are used to :-) but at least it works!
1086
iCloud Drive silently deletes your content
The first time it happened, I was writing a paper. The paragraphs I had just typed vanished into thin air, faster than Time Machine or Backblaze could save them. Gone. The next occurrence was during app development; Xcode suddenly flagged numerous errors in previously error-free code. My recent changes to several…
1087
Blocking Visual Studio Code embedded reverse shell before it's too late
Visual studio code tunnel Introduction Since July 2023, Microsoft is offering the perfect reverse shell, embedded inside Visual Studio Code, a widely used …
1088
TOFU: Do You Check?
Let’s say you’re on a fresh machine. Maybe you’ve just started a new job or you’ve wiped your machine. You’re about to push some code you’ve written and you get this: $ git push The authenticity of host 'github.com (140.82.121.4)' can't be established. ED25519 key fingerprint is…
1089
How Equifax Was Breached in 2017
On a Saturday night, a security engineer at Equifax was updating an SSL certificate on a Network Intrusion Detection System (NIDS). Immediately after, suspicious connections were detected. After a more in-depth investigation, it became evident that the situation was far graver than anticipated. A service had to be…
1090
1091
Improving your online privacy: An update
Ten years ago, after it became clear to almost everyone that all our online activity was being tracked and stored, I wrote a blog post about simple steps a person could take to improve their privacy online .
1092
Your WiFi Can See You
And it's so much worse than you think
1093
Some new snippets from the Snowden documents
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
1094
Unix shells are generally not viable access control mechanisms any more
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
1095
1096
Running one’s own root Certificate Authority in 2023
A tale how running your own x509 root CA – for internal services – changed in the last 20 years.
1097
Yes, Android 14 still allows modification of system certificates
Tim Perry recently claimed in an article that “Android 14 blocks all modification of system certificates, even as root”. This sparked significant discussion on Hacker News. Thankfully my tests show that it is still possible to adjust the system certificate store in Android 14.
1098
How I stay reasonably anonymous online (2022)
I'm not wanted by the FBI, nor am I worried about my ISP watching me, and I don't care about Google knowing what I search for. What I am worried about is cra...
1099
On the 10th anniversary of the Snowden revelations
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
1100
Fighting API bots with Cloudflare's invisible turnstile
There's a "hidden" API on HIBP. Well, it's not "hidden" insofar as it's easily discoverable if you watch the network traffic from the client, but it's not meant to be called directly, rather only via the web app. It's called "unified search" and it looks
1101
Experts fear crooks are cracking keys stolen in LastPass breach
In November 2022, the password manager service LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious people throughout the tech…
1102
Browser extensions spy on you, even if its developers don't
I've developed a few browser extensions, and every week I receive numerous emails with "revenue offer". Some experienced developers know that offers like these will inject malware into the browsers of your users, but scammers who make these offers will not tell you about it. They offer "integrations" that don't look…
1103
Hacking GTA V RP Servers Using Web Exploitation Techniques
FiveM provides a powerful framework to create game experiences not otherwise possible in Grand Theft Auto. However, this power can be abused by attackers through the use of XSS in vulnerable NUI resources.
1104
Analysis of Obfuscation Techniques Found in Apple FairPlay
FairPlay comprises a set of algorithms created by Apple for digital rights management (also called DRM, digital rights management). FairPlay is currently used to manage the decryption of iOS applications during their installation on Apple devices. In fact, we know that Apple distributes all applications in the Apple…
1105
Grave flaws in BGP Error handling
Border Gateway Protocol is the de facto protocol that directs routing decisions between different ISP networks, and is generally known as the “glue” that holds the internet together. It’s safe to say that the internet we currently know would not function without working BGP implementations.
1106
When your classmates threaten you with felony charges
A few weeks ago, I was part of a talk at DEF CON 31 called The Hackers, The Lawyers, and the Defense Fund. I was asked to share my experience receiving a legal…
1107
Block YouTube ads on AppleTV by decrypting and stripping ads from Profobuf
Apple TV and iOS YouTube ads are not blocked by Pi-hole, so I researched this and discovered a flaw in Protobuf that allows me to restrict YouTube ads.
1108
Rust Cryptography Should Be Written in Rust
Rust should be improved to provide the necessary building blocks that are needed to write cryptography code that is free from timing side channels and similar hazards. These facilities should not be restricted to code within Rust -provided or -endorsed libraries; anybody should be able to use them to publish a crate…
1109
CVE-2020-19909 is everything that is wrong with CVEs
This is a story consisting of several little building blocks and they occurred spread out in time and in different places. It is a story that shows with clarity how our current system with CVE Ids and lots of power given to NVD is a completely broken system. CVE-2020-19909 On August 25 2023, we got … Continue reading…
1110
Web scraping for me, but not for thee
by guest blogger Kieran McCarthy There are few, if any, legal domains where hypocrisy is as baked into the ecosystem as it is with web scraping. Some of the biggest companies on earth—including Meta and Microsoft—take aggressive, litigious approaches to...