3001
Authorization in a Microservices World
Authorization? How hard can it be? I am pretty sure that others have already solved it. We are not the first ones doing microservices. It should be easy to integrate what's already out there.
New
The latest blog posts to take off on Hacker News. 8,771 posts.
3002
How we secure Monzo's banking platform
Our Security Infrastructure team introduces the principles we follow to build security in Monzo’s fast-moving engineering environment and how they work with other engineering teams to keep our customers and platform safe.
3003
Fake emergency search warrants draw scrutiny from Capitol Hill
On Tuesday, KrebsOnSecurity warned that hackers increasingly are using compromised government and police department email accounts to obtain sensitive customer data from mobile providers, ISPs and social media companies. Today, one of the U.S. Senate’s most tech-savvy lawmakers said he was troubled by the report and…
3004
I'm a scam prevention expert and I got scammed
When discussing scams and social engineering attacks, it's easy for security experts to imply the victims of these attacks should have known better. And, as much as we may like to think we'd handle these situations so much better, that's just not true.
3005
How Go mitigates supply chain attacks
Go tooling and design help mitigate supply chain attacks at various stages.
3006
FORCEDENTRY: Sandbox Escape
Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen...
3007
Spring Core on JDK9 is vulnerable to remote code execution
Update: March 31, 2022 A patch has officially been released. https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement https://tanzu.vmware.com/security/cve-2022-22965 Overview Spring Core on JDK9+ is vulnerable to remote code execution due to a bypass for CVE-2010-1622. At the time of writing, this…
3008
Stage win: FinFisher is bankrupt
FinFisher, the Munich-based state Trojan exporter, is bankrupt. For over a decade, a wide variety of international groups, including the CCC, have worked toward its end.
3009
3010
Hackers gaining power of subpoena via fake “emergency data requests”
There is a terrifying and highly effective “method” that criminal hackers are now using to harvest sensitive customer data from Internet service providers, phone companies and social media firms. It involves compromising email accounts and websites tied to police departments and government agencies, and then sending…
3011
Today Google is turning on tracking for many users that previously turned it off
Workspace admins can no longer deactivate Google activity tracking for their users, Google says this is helping people.
3012
The phones of Ukrainian president Zelensky
Interesting telephone equipment in the offices of Ukrainian president Zelensky
3013
Mystery GPS Tracker on a Supporter’s Car
Being able to accurately determine your location anywhere on the planet is a useful technological trick. But when tracking isn’t done by you, but to you—without your knowledge or consent—it’s a violation of your privacy. That’s why at EFF we’ve long fought against dragnet surveillance, mobile...
3014
Countering threats from North Korea
On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, …
3015
Gaining security and privacy by partitioning the cache | Blog
Chrome's HTTP cache partitioning helps with better security and privacy.
3016
Interoperability without sacrificing privacy: Matrix and the DMA
Matrix, the open protocol for secure decentralised communications
3017
Racing against the clock – hitting a tiny kernel race window
TL;DR: How to make a tiny kernel race window really large even on kernels without CONFIG_PREEMPT...
3018
If you’re not using SSH certificates you’re doing SSH wrong (2019)
SSH has some pretty gnarly issues when it comes to usability, operability, and security. The good news is this is all easy to fix. SSH is ubiquitous. It’s the de-facto solution for remote administration of *nix systems. SSH certificate authentication makes SSH easier to use, easier to operate, and more secure.
3019
A Closer Look at the Lapsus$ Data Extortion Group
Microsoft and identity management platform Okta both this week disclosed breaches involving LAPSUS$ , a relatively new cybercrime group that specializes in stealing data from big companies and threatening to publish it unless a ransom demand is paid. Here’s a closer look at LAPSUS$, and some of the low-tech but…
3020
3021
Another Vulnerability in the LPC55S69 ROM
The discovery of an undocumented hardware block in the LPC55S69.
3022
3023
DEV-0537 targeting organizations for data exfiltration and destruction
The activity we have observed has been attributed to a threat group that Microsoft tracks as DEV-0537, also known as LAPSUS$. DEV-0537 is known for using a pure extortion and destruction model without deploying ransomware payloads.
3024
Nintendo Switch prevents downgrades by irreparably blowing its own fuses (2020)
How the Nintendo Switch uses irreversible hardware fuses to prevent firmware downgrades.
3025
3026
3027
KeePassXC 2.7.0
KeePassXC Password Manager
3028
LTrack: Stealthy Tracking of Mobile Phones in LTE
Martin Kotuliak, Simon Erni, Patrick Leu, Marc Röschlin, and Srdjan Čapkun, ETH Zurich
3029
Automating cookie consent and GDPR violation detection
The European Union's General Data Protection Regulation (GDPR) requires websites to inform users about personal data collection and request consent for cookies. Yet the majority of websites do not give users any choices, and others attempt to deceive them into accepting all cookies. We document the severity of this…
3030
Is macOS Look Up Destined for CSAM?
Remember Apple’s failed attempt to detect CSAM in images? Would that have been similar to the way that Visual Look Up works? Is this the thin end of the wedge?