The latest blog posts to take off on Hacker News. 4,335 posts.
This is a special post because I fully based on another researcher, s1guza’s 0day. All of this story began from the following tweet: Siguza told us that his 0day was patched in the iOS 13.5 beta3. So this is actually a sandbox escape 0day for the newest, non-beta iOS version (13.4.1). In this post, I’ll…
What happens when you forget your password or loose your phone? What Google wants to know to validate your identity?
In this post I show some of my findings during the reverse engineering of the apps Coffee Meets Bagel and The League. I have identified several critical vulnerabilities during the research, all of which have been reported to the affected vendors. Introduction In these unprecedented times, more and more people are…
Siguza’s Blog
I was quoted in BuzzFeed: “My problem with contact tracing apps is that they have absolutely no value,” Bruce Schneier, a privacy expert and fellow at the Berkman Klein Center for Internet & Society at Harvard University, told BuzzFeed News. “I’m not even talking about the privacy concerns, I mean the efficacy. Does…
Stripe has made several significant, positive changes to its user tracking and privacy policies in the last week.
Breaches have been found on websites including Wish.com, JetBlue.com, Quibi.com, WashingtonPost.com, NGPVan.com and numerous other…
This blog post discloses a sandbox escape on macOS. I reported the issue to Apple Product Security on December 19 2019, the day the Apple Security Bounty program finally opened. (I discovered the issue in August 2019.) Today I received an email from Apple Product Security saying "we do not see any actual security…
I wrote a bit about my reasoning to De-Google here . Now I want to write a bit about my progress, the struggles and what I ended up with.
You may have heard that today’s phone fraudsters like to use caller ID spoofing services to make their scam calls seem more believable. But you probably didn’t know that these fraudsters also can use caller ID spoofing to trick your bank into giving up information about recent transactions on your account — data that…
With a questionable claim to copyright, Jay-Z ordered two deepfake audio parodies of his voice off YouTube. I talked to the video's creator about the future of AI for creative expression.
A TCP reset attack is executed using a single packet of data, no more than a few bytes in size. A spoofed TCP segment, crafted and sent by an attacker, tricks two victims into abandoning a TCP connection, interrupting possibly vital communications between them.
Fuzz testing is a bit like the infinite monkey theorem, but instead of Shakespeare you get crashes.
Prologue Bluezone ( Android , iOS ) is a Bluetooth-based contact tracing app sponsored by the Government of Vietnam and developed by a c...
Recently while conducting some research, I found myself down the path of Google Analytics ID's as well as other analytics services. I was investigating ways to not only identify varying analytics code in sites, but to correlate them with ot…
Many security-conscious people probably think they’d never fall for a phone-based phishing scam. But if your response to such a scam involves anything other than hanging up and calling back the entity that claims to be calling, you may be in for a rude awakening. Here’s how one security and tech-savvy reader got taken…
An investigation into how Stripe tracks your users and what you can do to prevent it
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
The past few weeks have seen a large number of new domain registrations beginning with the word “reopen” and ending with U.S. city or state names. The largest number of them were created just hours after President Trump sent a series of all-caps tweets urging citizens to “liberate” themselves from new gun control…
I wrote a critical piece about the Google Apple Contact Tracing (GACT) platform a few days ago . This resulted in quite some discussion, which brought some more arguments to the fore, that I would like to address and clarify here. Here I focus on my area of expertise: privacy. My colleague Tamar Sharon wrote an…
Apple and Google released a joint specification that allows both iPhones and Android devices to do contact tracing on a global scale. Even though "privacy, transparency, and consent are of utmost importance", this is a game changing event that has grave consequences. We must stop Apple and Google in their tracks. Or…
tl;dr: I like PurelyMail and I will slowly switch all my online accounts to use it. I've been using it for almost three months and I didn't have any issues (except with some Hotmail/Outlook addresses). I have a GMail account since 2006 (that's the date
Plus general overview
In February, KrebsOnSecurity told the story of a private citizen auctioning off the dangerous domain corp.com for the starting price of $1.7 million . Domain experts called corp.com dangerous because years of testing showed whoever wields it would have access to an unending stream of passwords, email and other…
Efficient elliptic curves tend not to have a prime order. This discusses the problems this causes, and the solutions.
