3031
Decrypting your own HTTPS traffic with Wireshark
Code level discussion of web scraping, gray hat automation, growth hacking and bounty hunting
New
The latest blog posts to take off on Hacker News. 8,771 posts.
3032
Mitmproxy 8
We’re delighted to announce the release of mitmproxy 8, a free and open source interactive HTTPS proxy. This release brings major improvements to mitmweb, our web interface, and new functionality for addon developers.
3033
Exploring Google Hangouts' easter eggs
Web developer and cybersecurity researcher
3034
Random number generator enhancements for Linux 5.17 and 5.18
The random number generator has undergone a few important changes for Linux 5.17 and 5.18, in an attempt to modernize both the code and the cryptography used. The smaller part of these will be released with 5.17 on Sunday, while the larger part will be merged into 5.18 on Monday, which should receive its first release…
3035
3036
NPM package compromised by author: erases files on RU / BY computers on install
Vue.js users using the dependency “node-ipc” are experiencing a supply chain attack protesting the invasion of Ukraine, from a package named “peacenotwar”.
3037
Browser in the Browser (BITB) Attack
Providing security research and red team techniques
3038
What is: Linux keyring, gnome-keyring, Secret Service, and D-Bus (2019)
What are Linux keyring, gnome-keyring, Secret Service, and D-Bus - a brief overview and usage examples
3039
3040
3041
Arti – An implementation of Tor in Rust
Arti 0.1.0 is released, and available for download.
3042
3043
Some discouraging anecdotes on how services handle account deletions
I asked 124 services to delete my user account. The results were mixed. 21 never responded, and 16 responded by created even more accounts. Some outright lied.
3044
iCloud Private Relay: What Cloudflare Customers Need to Know
iCloud Private Relay is an Apple service for browsing more privately and securely. Learn how to ensure the best user experience using iCloud Private Relay.
3045
Who's Attacking My Server?
One of the unexpected 1 outcomes of the Russian invasion in Ukraine is a large increase in nefarious access attempts to servers under my control, not necessarily appearing to arise from Russian IP addresses. There are the usual attempts at brute-forcing SSH access, for instance, but also a flurry of malevolent HTTP(S)…
3046
3047
A lock with many keys: Spoofing DNSSEC-signed domains in 8.8.8.8
We discovered that, until recently, Google Public DNS was theoretically vulnerable to a DNS cache poisoning attack on DNSSEC-signed domain names. Google fixed the vulnerability as a result of our report
3048
Why Single Sign on Sucks
A deep dive into the UX of current single sign-on and an overview of possible solutions.
3049
Attackers exploit flaw in web’s security to steal $2M in cryptocurrency
By Henry Birge-Lee, Liang Wang, Grace Cimaszewski, Jennifer Rexford and Prateek Mittal On Thursday, Feb. 3, 2022, attackers stole approximately $2 million worth of cryptocurrency from users of the Korean crypto exchange KLAYswap. This theft, which was detailed in a Korean-language blog post by the security firm S2W…
3050
3051
Apple AirTags draining battery of devices close by
If you have AirTags in the vicinity of your iPad it drains its battery for no reason. The past months I’ve been wondering why my iPad Pro always needed to be recharged when I used to use it without charging for weeks. I’m not the only one…
3052
820GB Database Dump of Roskomnadzor (Russian Government Censorship Organization)
In the Cyberwar category, we are listing 364,000 files from the Roskomnadzor, the Russian federal agency responsible for censorship of Russian media, specifically from the republic of Bashkortostan.
3053
Why offer an Onion Address rather than just encourage browsing-over-Tor?
There are a bunch of reasons to launch an onion site, and a bunch of benefits, all of which have provided value to platforms such as Facebook, the BBC or NYT Onions. The first benefits are authenti…
3054
Building Password Purgatory with Cloudflare Pages and Workers
I have lots of little ideas for various pet projects, most of which go nowhere ( Have I Been Pwned [https://haveibeenpwned.com/] being the exception), so I'm always looking for the fastest, cheapest way to get up and running. Last month as part of my blog post on How
3055
An unexpected Redis sandbox escape affecting Debian-based distros
This post describes how I broke the Redis sandbox, but only for Debian and Debian-derived Linux distributions. Upstream Redis is not affected. That makes it a Debian vulnerability, not a Redis one. The culprit, if you will, is dynamic linking, but there will be more on that later.
3056
TP240PhoneHome Reflection/Amplification DDoS Attack Vector
A new reflection/amplification distributed denial of service (DDoS) vector with a record-breaking potential amplification ratio of 4,294,967,296:1 has been abused by attackers in the wild to launch multiple high-impact DDoS attacks.
3057
Put an io_uring on it: Exploiting the Linux kernel
How much do you know about system calls and how they introduce security risks? We shed light on these interactions and how security teams monitor them.
3058
The AMD Branch (Mis)Predictor Part 2: Where No CPU Has Gone Before
In this blog post, OSS Security Researcher Pawel Wieczorkiewicz shares his journey from trying to save one byte of code to the discovery of two new cases of Straight-Line-Speculation (SLS) which affect the Zen1 and Zen2 microarchitectures of AMD CPUs. Using the findings presented in his earlier blog on the AMD branch…
3059
Google Cloud to acquire Mandiant for $5.4B
MOUNTAIN VIEW, Calif. (March 8, 2022)—Google LLC today announced that it has signed a definitive agreement to acquire Mandiant, Inc., a leader in dynamic cyber defense and response, for $23.00 per share, in an all-cash transaction valued at approximately $5.4 billion, inclusive of Mandiant’s net cash. Upon the close…
3060
Google to Acquire Mandiant
Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.