3061
An update on the threat landscape
Online security is extremely important for people in Ukraine and the surrounding region right now. Government agencies, independent newspapers and public service provide…
New
The latest blog posts to take off on Hacker News. 8,771 posts.
3062
Critical cross-account vulnerability in Microsoft Azure automation service
AutoWarp is a critical vulnerability in Microsoft Azure Automation Service that allows unauthorized access to other customer accounts using the service.
3063
SATCOM terminals under attack in Europe: a plausible analysis
------ Update 03/12/2022 Reuters has published new information on this incident, which initially matches the proposed scenario. You can find...
3064
Windows Defender is enough, if you harden it
This article is not intended to convince you to abandon your current antivirus solutions. In this post I would like to share my observations and ways to improve the effectiveness of Defender. You don’
3065
What's the risk from fake Yubikeys?
I found this on a security-related Slack (shared with permission). It launched an entertaining discussion about the risks of taking a potentially fake FIDO token. We all know the risks of taking a free USB drive and shoving it in our computer, right? USB sticks can install software, act as a keylogger, transmit data…
3066
Escaping privileged containers for fun
Despite the fact that it is not a 'real' vulnerability, escaping privileged Docker containers is nevertheless pretty funny. And because there will always be people who will come up with reasons or excuses to run a privileged container (even though you really shouldn't), this could really be handy at some point in the…
3067
Finding an authorization bypass on my own website
The mysqljs parameterized query parser handles objects as column name and key, leading to alterations of the query.
3068
Mozilla patches two use-after-free vulnerabilities (ab)used in the wild
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw.
3069
The perils of the “real” client IP
This post ended up being incredibly long comprehensive. I’m afraid that many people won’t read enough to get everything that’s important, so here are the key points:
3070
Retrieving your browsing history through a CAPTCHA
Web developer and cybersecurity researcher
3071
3072
Help Censored Users – Run a Tor Bridge
Today the Tor Project is launching the Run a Tor Bridge campaign. Participants are invited to contribute and help censored users by running a Tor bridge. You can find more details below, including our special reward kits for participants. The campaign will run from November 17 to January 7, 2022. Join us and help…
3073
New Linux vulnerability affecting cgroups: can containers escape?
CVE-2022-0492 is the third recent kernel vulnerability that allows malicious containers to escape. We offer root cause analysis and mitigations.
3074
3075
The new White House memo on zero trust is a strong signal
The new White House memo on zero trust is a strong signal that the US federal government is taking an active stance regarding cybersecurity. Not only does this have far-reaching ramifications for the public and private sectors, it also serves to cut through the noise about zero trust with an impartial source. Let’s…
3076
3077
3078
Anatomy of a JWT
Technical article explains JSON Web Tokens (JWT), their component parts, and how they are used for authentication.
3079
How to earn money by hacking a “walking for money” app
Or how to reverse engineer React Native apps, and abuse API.
3080
A planned EU regulation about website certificates is causing concern
Feisty Duck’s Cryptography & Security Newsletter is a periodic dispatch bringing you commentary and news surrounding cryptography, security, privacy, SSL/TLS, and PKI. It's designed to keep you informed about the latest developments in this space. Enjoyed every month by more than 50,000 subscribers. Written by Hanno…
3081
Briar has been removed from Google Play
Status update Update (February 28, 13:20 UTC): Briar is available on Google Play again. Briar was briefly removed from Google Play because we didn’t provide Google’s review team with a username and password for testing the app. We provided Google with a username and password for testing and the app is now available…
3082
3083
GitHub’s database of security advisories is now open source
Anyone can now provide additional information and context to further the community’s understanding and awareness of security advisories.
3084
Gitlab Critical Security Release
GitLab release announcements and feature highlights.
3085
Is Grammarly a keylogger? What can you do about it?
Is Grammarly a keylogger? Here's what to consider so employees can reap the benefit of this valuable tool without compromising data security.
3086
A practical guide to securing Google Workspace for a startup
View the Fleet handbook.
3087
Don't Use RAR
Group for Apps and Services on Exascale Research Infrastructure is a research, development, and teaching unit at FIDIT + MedRi.
3088
Cloudflare to acquire Area 1 Security for $162M
Earlier today we announced that Cloudflare has agreed to acquire Area 1 Security
3089
Detecting Monero Miners with Bpftrace
Pixie Blog
3090
Missouri governor’s office responsible for teacher data leak
Missouri Governor Mike Parson made headlines last year when he vowed to criminally prosecute a journalist for reporting a security flaw in a state website that exposed personal information of more than 100,000 teachers. But Missouri prosecutors now say they will not pursue charges following revelations that the data…