3151
An ad plugin was stealing revenue for a year and I didn't even notice
Anyone can build their own amusement park here, or find one that's just right for them. A city of parks by Levan Kvirkvelia.
New
The latest blog posts to take off on Hacker News. 8,771 posts.
3152
MoonBounce: The dark side of UEFI firmware
At the end of 2021, we inspected UEFI firmware that was tampered with to embed a malicious code we dub MoonBounce. In this report we describe how the MoonBounce implant works and how it is connected to APT41.
3153
The most backdoor-looking bug I’ve ever seen (2021)
This is the story of a bug that was discovered and fixed in Telegram’s self-rolled cryptographic protocol about seven years ago. The bug didn’t get any press, and no one seems to know about it, probably because it was only published in Russian.
3154
3155
3156
An Armful of CHERIs
Microsoft Security Response Center Blog2022105 points24 commentscited by 3Security & Privacy details
Today, Arm announced that the first silicon supporting the Morello prototype architecture, a research project led by Arm, Microsoft, University of Cambridge and others, is now available on a limited run of demonstration boards, which are being shipped from today to industry partners for testing. Morello is the first…
3157
IRS Will Soon Require Selfies for Online Access
If you created an online account to manage your tax records with the U.S. Internal Revenue Service (IRS), those login credentials will cease to work later this year. The agency says that by the summer of 2022, the only way to log in to irs.gov will be through ID.me , an online identity verification service that…
3158
Nine-year-old kids are launching DDoS attacks against schools
Britain's computer crime cops are targeting youngsters as young as nine years old in an attempt to dissuade them from embarking on a life of cybercrime.
3159
1Password Has Raised $620M
As our online lives become subject to new and evolving threats, we're doubling down on protecting the digital privacy and peace of mind of everyday people – at home and at work.
3160
Austria's data protection authority has found that Google Analytics is illegal
Using Google Analytics in a legally compliant way is still possible in Europe. Here we explain how.
3161
Discovering a security vulnerability in a major grocery delivery platform
We felt more like “Oh fuck, Databreach” Dieser Artikel ist auch auf deutsch erschienen. During the pandemic, grocery delivery services gained popularity. New players on the market offer delivery in under an hour. One of them is Gorillas, which not only delivers apples and granola bars in 10 minutes, but just as…
3162
Zooming in on Zero-Click Exploits
Posted by Natalie Silvanovich, Project Zero Zoom is a video conferencing platform that has ...
3163
Systemd service sandboxing and security hardening (2020)
The systemd-analyze security command gives your systemd service units an automated security rating. This is a good starting point for security hardening.
3164
Real-world stories of how we’ve compromised CI/CD pipelines
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
3165
The curious case of the Raspberry Pi in the network closet (2019)
Personal Blog of Christian Haschek
3166
Exploiting IndexedDB API information leaks in Safari 15
Discover how a software bug in Safari 15's IndexedDB API can track your online activity and reveal your identity.
3167
Big Time Public License
a FRAND-ly license for software
3168
SSH Bastion Host Best Practices
Learn 14 best practices to build and deploy a security-hardened SSH bastion host based on OpenSSH server.
3169
Austrian DSB: EU-US Data Transfers to Google Analytics Illegal
In a groundbreaking decision, the Austrian Data Protection Authority has decided on a model case by noyb that the continuous use of Google Analytics violates the GDPR.
3170
Dark Web – Justice League
Uncover the hidden world of Dark Web justice as cybercriminals settle disputes in underground courts. Explore verdicts, high-profile cases, and more.
3171
Mullvad: Diskless infrastructure using stboot in beta
Diskless infrastructure using stboot (in beta) is now available on a pair of WireGuard servers in Sweden.
3172
New SysJoker Backdoor Targets Windows, Linux, and macOS
In December 2021, we discovered a new multi-platform backdoor that targets Windows, Mac, and Linux that we have named SysJoker.
3173
Indian threat actor Patchwork APT caught in its own web
ThreatDown Patchwork Apt Caught In Its Own Web: threat intelligence on Patchwork APT tactics, targets, and how to detect and stop this threat.
3174
What NPM should do to stop a new colors attack
Over the weekend, a developer named Marak Squires intentionally sabotaged his popular NPM package colors and his less popular package faker . As I write this, NPM claims 18,971 direct dependents for colors and 2,751 for faker . Open Source Insights counts at least 42,000 more indirect dependents for colors . Many…
3175
3176
CalyxOS now supports Pixel 6 and Pixel 6 Pro
Android 12, Pixel 6
3177
SSH Agent Restriction (new in OpenSSH 8.9)
OpenSSH agent restriction
3178
3179
Hashing is not encryption
Encryption, encoding, and hashing are three related but distinct concepts. It’s important for you to understand all three.
3180
500M Avira antivirus users introduced to cryptomining
Many readers were surprised to learn recently that the popular Norton 360 antivirus suite now ships with a program which lets customers make money mining virtual currency . But Norton 360 isn’t alone in this dubious endeavor: Avira antivirus — which has built a base of 500 million users worldwide largely by making the…