2071
Third-Party Audit of Rustls
In May and June 2020, Cure53 completed an audit of ring , webpki , and rustls . Their report ( PDF ) fully describes the audit, and makes for interesting reading.
New
The latest blog posts to take off on Hacker News. 4,335 posts.
2072
Lamphone: Real-Time Passive Sound Recovery from Light Bulb Vibrations
Recent studies have suggested various side-channel attacks for eavesdropping sound by analyzing the side effects of sound waves on nearby objects (e.g., a bag of chips and window) and devices (e.g., motion sensors). These methods pose a great threat to privacy, however they are limited in one of the
2073
2074
SeL4 is verified on RISC-V
Sounds great! But what does it mean? seL4 seL4 (pronounced ess-e-ell-four) is arguably the world’s most secure operating system (OS) kernel. The OS kernel is the lowest level of software runn…
2075
The Impending Doom of Expiring Root CAs and Legacy Clients
Regular readers will know that I'm very active in the CA / PKI space and even deliver a 2-day advanced training course [https://www.feistyduck.com/training/the-best-ssl-and-tls-training-in-the-world] on the topic. Over the last year or so I've been watching
2076
The Brave web browser is hijacking links, and inserting affiliate codes
How does this keep happening? It is a mystery.
2077
eBay is port scanning visitors to their website
Websites are scanning for open ports on your PC to help fight fraud, but this data also flows into a massive, global tracking database.
2078
Analysing the alleged Minneapolis police department “hack”
The situation in Minneapolis at the moment (and many other places in the US) following George Floyd's death [https://en.wikipedia.org/wiki/Death_of_George_Floyd] is, I think it's fair to say, extremely volatile. I wouldn't even know where to begin commentary on that, but
2079
Finding secrets by decompiling Python bytecode in public repositories
Cache rules everything around me. `pyc` files can contain secrets and should not be checked in to source control. Use the standard Python [.gitignore](https://github.com/github/gitignore/blob/master/Python.gitignore).
2080
Zero-day in Sign in with Apple
What if I say, your Email ID is all I need to takeover your account on your favorite website or an app. Sounds scary, right? This is what a…
2081
Career Choice Tip: Cybercrime Is Mostly Boring
When law enforcement agencies tout their latest cybercriminal arrest, the defendant is often cast as a bravado outlaw engaged in sophisticated, lucrative, even exciting activity. But new research suggests that as cybercrime has become dominated by pay-for-service offerings, the vast majority of day-to-day activity…
2082
Linux Security Hardening and Other Tweaks
A collection of kernel and userland settings one can change to improve the security and usability of a Linux system. Targeted at Arch, but should work for other distros too.
2083
The radix 2^51 trick (2017)
Starting from the “ones” position, we add 6 + 6 = 12, write down a 2 and carry a 1. We proceed to the left, one position at a time, until there are no more digits to add.
2084
2085
Bahamas Company Registry Leaked
The people are the best thing about a life in science fiction – eclectic, bright, opinionated, talented – people like Elise Mathson: writer, jeweller, and all-round brilliant person (she's up for a Hugo this year).
2086
2087
A Guide to Threat Modelling for Developers
Threat modeling is a risk based approach to cyber security requirements analysis.
2088
2089
Catalina is checking notarization of unsigned executables
This is a follow-up to Allan Odgaard's excellent article macOS 10.15: Slow by Design . I want to talk specifically about the first section "Spawning a new Process", because there has been widespread misunderstanding of this. Odgaard provides a simple test to show that the first run of an executable is delayed while…
2090
Stealing secrets from developers using WebSockets
This is a story of a convoluted, not-very-useful method for extracting codez from unwitting JavaScript developers working on top secret…
2091
2092
2093
Why Is This Website Port Scanning Me?
Investigation of the practice of port scanning site visitors for fingerprinting and tracking.
2094
How to Use Trend Micro's Rootkit Remover to Install a Rootkit
The opinions expressed in this publication are those of the authors. They do not reflect the opinions or views of my employer. All research was conducted independently. For a recent project, I had to do research into methods rootkits are detected and the most effective measures to catch them when
2095
US Secret Service: “Massive Fraud” Against State Unemployment Insurance Programs
A well-organized Nigerian crime ring is exploiting the COVID-19 crisis by committing large-scale fraud against multiple state unemployment insurance programs, with potential losses in the hundreds of millions of dollars, according to a new alert issued by the U.S. Secret Service .
2096
The unattributable “db8151dd” data breach
I was reticent to write this blog post because it leaves a lot of questions unanswered, questions that we should be able to answer. It's about a data breach with almost 90GB of personal information in it across tens of millions of records - including mine. Here's what I
2097
Security Flaws in Adobe Acrobat Reader Allow Gaining Root on macOS Silently
Yuebin Sun(@yuebinsun2020) of Tencent Security Xuanwu Lab 0x0 SummaryToday, Adobe Acrobat Reader DC for macOS patched three critical vulnerabilities(CVE-2020-9615, CVE-2020-9614, CVE-2020-9613) I repo
2098
White hat social engineering: How to become an admin of a system
Warning: Half-satire, half-truth
2099
The Original Cookie specification from 1997 was GDPR compliant (2019)
Baekdal is your premium site for media reports and trend analysis. Subscribe from €7.55/month
2100
Dissecting an SSL Certificate (2017)
Dissecting an SSL certificate