1
How did LastPass master passwords get compromised?
LastPass accounts are under attack. I look into how user’s master passwords might have leaked.
New
The latest blog posts to take off on Hacker News. 312 posts.
2
Anonymized data is rarely anonymous
Justin Sherman for Wired points out the farce that is anonymized data: Data on hundreds of millions of Americans’ races, genders, ethnicities, religions, sexual orientations, political beliefs, int…
3
How Secure Boot Works on M1 Series Macs
This article has now been extensively corrected and modified.
4
5
6
7
Knock Knock Who's There? – An NSA VM
Back in 2017 (feels like ages ago) I decided to take a peek into the ShadowBrokers leaks and reverse some of the tools. I started on dewdrop simply because it had a macOS version. I made local presentations at 0xOpoSec and BSidesLisbon but those slides were never published for obvious reasons (aka live implants all…
8
Analysis and reverse-engineering of the original Starlink router
Honestly, I love the design of this thing. It reminds me of something from the good old sci-fi.
9
10
Cache Poisoning at Scale
Identifying and exploiting over 70 cache poisoning vulnerabilities across major bug bounty programs, including GitHub, GitLab, Shopify and HackerOne.
11
Isolating Xwayland in a VM
In my last post, Qubes-lite with KVM and Wayland, I described setting up a Qubes-inspired Linux system that runs applications in virtual machines. A …
12
Hidden Networks in TP-Link Routers
I was debugging my WiFi settings this week when I noticed something strange. WiFi Analyzer was showing two hidden networks coming from my router, one for each frequency: 2.4GHz and 5GHz. Networks which I haven't configured and didn't appear in my router's admin interface. WTF?
13
RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
The Visual Studio Code server in Windows Subsystem for Linux uses a local WebSocket WebSocket connection to communicate with the Remote WSL extension. JavaScript in websites can connect to this server and execute arbitrary commands on the target system. Assigned CVE-2021-43907 and zero bounty. I paid 5 USD for the EC2…
14
Inverting PhotoDNA
Ribosome inverts Microsoft PhotoDNA hashes using machine learning.
15
An iframe from googlesyndication.com tries to access the camera and microphone
The last thing we want is for an advertising network to access the Camera or Microphone on our computer. But, while looking for something else, I stumbled upon messages in the Safari JavaScript console saying that an iframe loaded from safeframe.googlesyndication.com tried to do exactly that.
16
17
CCPA Scam – Human subject research study conducted by Princeton University
Get ready for the CCPA compliance scams from Princeton.
18
NY Man Pleads Guilty in $20M SIM Swap Theft
A 24-year-old New York man who bragged about helping to steal more than $20 million worth of cryptocurrency from a technology executive has pleaded guilty to conspiracy to commit wire fraud. Nicholas Truglia was part of a group alleged to have stolen more than $100 million from cryptocurrency investors using…
19
Clever uses of pass, the Unix password manager
Pass ( main site , Arch wiki ) is a command-line Unix password manager that utilizes GPG for all underlying encryption. However, beyond passwords, we can utilize it in a number of clever ways.
20
Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide
Summary of CVE-2021-4228 (Log4Shell), trivial RCE in log4j, a common Java logging framework. Includes list of affected platforms.
21
22
Log4j: Between a rock and a hard place
There is more than enough written on the mechanics of and mitigations for the recent severe RCE in log4j . On prevention, this is the most interesting widely-reshared insight I have seen:
23
24
Essential security for Linux servers (2013)
Father, Founder, and FuturistBuilding bestinterest.app and podcasting for coparents.Learn more about me.
25
26
Ubiquiti developer charged with extortion, causing 2020 “breach”
Last year, I posted a series of articles about a purported “breach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press.
27
Chrome client “variations” can be used to identify you (2020)
Until now I used Chrome with a few settings tweak like disabling sending usage statistics, uBlock origin, no crash reports and so on.
28
The Fraud Supply Chain
Fraud is largely conducted by professionals operating in specialized firms, which have their own ecosystem of evil.
29
Testing Phone-Sized Faraday Bags
Complex software is, to put it mildly, hard to get right (for details, see almost any other posting on this or any other security blog). Especially for gadgets that are rich with microphones, cameras, location and environmental sensors, and communication links (such as, you know, smartphones), errors and security…
30