3271
Apple sues NSO Group to curb the abuse of state-sponsored spyware
Apple today filed a lawsuit against NSO Group to hold it accountable for abusive surveillance and the targeting of a small number of Apple users.
New
The latest blog posts to take off on Hacker News. 8,771 posts.
3272
3273
SugarCoat: Private browsing without breaking the web
A team of computer scientists at the University of California San Diego and Brave Software. have developed a tool that will increase protections for users’ private data while they browse the web.
3274
3275
Fingerprints can be hacked
Fingerprint authentication is a convenient alternative to passwords and PIN codes. Who wants to spend time typing in a lengthy string of numbers, letters and characters when a simple tap will suffice? Unfortunately, that convenience comes at a cost. Because, unlike a regular password, you leave your fingerprint on…
3276
What every IT person needs to know about OpenBSD Part 3: That packet filter
Useful and fun features related to the OpenBSD packet filter.
3277
Is Microsoft Stealing People’s Bookmarks?
I received email from two people who told me that Microsoft Edge enabled synching without warning or consent, which means that Microsoft sucked up all of their bookmarks. Of course they can turn synching off, but it’s too late. Has this happened to anyone else, or was this user error of some sort? If this is real, can…
3278
ChaosDB Explained: Azure's Cosmos DB Vulnerability Walkthrough
This is the full story of the Azure ChaosDB Vulnerability that was discovered and disclosed by the Wiz Research Team, where we were able to gain complete unrestricted access to the databases of several thousand Microsoft Azure customers.
3279
The ‘Zelle fraud’ scam: how it works, how to fight back
One of the more common ways cybercriminals cash out access to bank accounts involves draining the victim’s funds via Zelle , a “peer-to-peer” (P2P) payment service used by many financial institutions that allows customers to quickly send cash to friends and family. Naturally, a great deal of phishing schemes that…
3280
Backdooring Rust crates for fun and profit
Supply chains attacks are all the rage these days, whether to deliver RATs, cryptocurrencies miners, or credential stealers. In Rust, packages are called crates and are (most of the time) hosted on a central repository: https://crates.io for better discoverability. We are going to study 8 techniques to achieve Remote…
3281
How we protect our most sensitive secrets from the most determined attackers
As a bank, we have a lot of secrets we need to protect to keep our customers and ourselves safe. These include private keys that only we know, which we use to digitally sign requests as coming from us (sort of like a private password). These private keys are super important and are used all over Monzo and when…
3282
Dangerous bug in Chrome’s ‘New Tab’ page bypassed security features
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
3283
TPM Sniffing
TL;DR : we reproduced Denis Andzakovic’s proof-of-concept showing that it is possible to read and write data from a BitLocker-protected device (for instance, a stolen laptop) by sniffing the TPM key from the LCP bus.
3284
New and improved Linux Random Number Generator ready for testing
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
3285
Security issue related to the NPM registry
We're sharing details of recent incidents on the npm registry, our investigations, and how we’re continuing to invest in the security of npm.
3286
I hate password rules
The other day, I was creating a new account on the web. It was financial in nature, which means it gets one of my most secure passwords. I used Password Safe to generate this 16-character alphanumeric password: :s^Twd.J;3hzg=Q~ Which was rejected by the site, because it didn’t meet its password security rules. It took…
3287
Chrome may start restricting requests to private networks
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
3288
Portugal proposed law tries to sneak in biometric mass surveillance
Whilst the European Parliament has been fighting bravely for the rights of everyone in the EU to exist freely and with dignity in publicly accessible spaces, the government of Portugal is attempting to push their country in the opposite direction: one of digital authoritarianism. The Portuguese lead organisation in…
3289
Blacksmith – Rowhammer bit flips on all DRAM devices today despite mitigations
We demonstrate that it is possible to trigger Rowhammer bit flips on all DRAM devices today despite deployed mitigations on commodity off-the-shelf systems with little effort. This result has a significant impact on the system’s security as DRAM devices in the wild cannot easily be fixed, and previous work showed…
3290
Briar 1.4 – Offline sharing, message transfer via SD cards and USB sticks
Press release The Briar Project released version 1.4 of its Android app today. This release adds a couple of new features, highlighted below. First of all, users can now share the app offline. Prior to this release, the only way to get the app was to to download it from the internet, which requires an internet…
3291
OAuth with Cloudflare workers on a statically generated site
An article on implementing OAuth user registration for a newsletter on a statically generated site using Cloudflare workers.
3292
3293
Hoax email blast abused poor coding in FBI website
The Federal Bureau of Investigation (FBI) confirmed today that its fbi.gov domain name and Internet address were used to blast out thousands of fake emails about a cybercrime investigation. According to an interview with the person who claimed responsibility for the hoax, the spam messages were sent by abusing…
3294
Cloudflare blocks an almost 2 Tbps multi-vector DDoS attack
Earlier this week, Cloudflare automatically detected and mitigated a DDoS attack that peaked just below 2 Tbps — the largest we’ve seen to date.
3295
Sign arbitrary data with your SSH keys
ssh-keygen can sign and verify signatures, and it's way better than PGP
3296
3297
macOS Zero-Day Used Against Hong-Kong Activists
Google researchers discovered a MacOS zero-day exploit being used against Hong Kong activists. It was a “watering hole” attack, which means the malware was hidden in a legitimate website. Users visiting that website would get infected. From an article: Google’s researchers were able to trigger the exploits and study…
3298
I'm unsure of the security of simultaneous multithreading on modern x86 CPUs
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
3299
3300
Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS
Modern web applications typically rely on chains of multiple servers, which forward HTTP requests to one another. The attack surface created by this forwarding is increasingly receiving more attention, including the recent popularisation of cache poisoning...