3721
64-Bit Linux Return-Oriented Programming
Update : Dongli Zhang reports that newer Linux versions organize the stack differently . The code below will need to be modified accordingly.
New
The latest blog posts to take off on Hacker News. 8,771 posts.
3722
Backblaze Privacy Update: Third-Party Tracking
Read this post for a privacy update regarding third-party tracking code on our website.
3723
The S in IoT is for Security
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
3724
Firefox 87 trims HTTP Referrers by default to protect user privacy
We are pleased to announce that Firefox 87 will introduce a stricter, more privacy-preserving default Referrer Policy. From now on, by default, Firefox will trim path and query string ...
3725
The world needs a software bill of materials
“Sunburst” was the most sophisticated hack the world has ever seen. One of the most urgent lessons so far learned from the attack: we need…
3726
Cryptography behind the top cryptocurrencies
This table is based on research at Nash for work expanding our MPC protocol to secure wallets on new blockchains. We took a snapshot of rankings by market cap in early February 2021. In summary, 74 coins use ECDSA and the secp256k1 curve, including Bitcoin, Ethereum, and 48 ERC20 tokens. 10 coins use EdDSA and…
3727
Safari is now probably the influential wild card browser for user privacy
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
3728
We found and fixed a rare race condition in our session handling
On March 8, out of an abundance of caution, we logged all users out of GitHub.com. In this post we share technical details of the vulnerability and steps we're taking to ensure it doesn't happen again.
3729
Reverse Engineering a Docker Image
This started with a consulting snafu: Government organisation A got government organisation B to develop a web application. Government organisation B subcontracted part of the work to somebody. Hosting and maintenance of the project was later contracted out to a private-sector company C. Company C discovered that the…
3730
Do not use redirection characters in your shell prompt
Over the years of troubleshooting performance problems in the Unix/Linux world, I have seen multiple cases where a regularly used command line tool in a customer server just stops working for some reason. The tool just returns immediately, doing absolutely nothing. No output printed, no coredumps and the exit code is…
3731
Fintech Giant Fiserv Used Unclaimed Domain
If you sell Web-based software for a living and ship code that references an unregistered domain name, you are asking for trouble. But when the same mistake is made by a Fortune 500 company, the results can range from costly to disastrous. Here’s the story of one such goof committed by Fiserv [ NASDAQ:FISV ], a $15…
3732
Claude Shannon: The Mathematical Theory of Cryptography
The foundation of modern cryptography.
3733
Avoid Consumer Routers
Consumer Routers are not secure
3734
Can We Stop Pretending SMS Is Secure Now?
SMS text messages were already the weakest link securing just about anything online, mainly because there are tens of thousands of employees at mobile stores who can be tricked or bribed into swapping control over a mobile phone number to someone else. Now we’re learning about an entire ecosystem of companies that…
3735
Librem Tunnel Is Leaving iOS
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
3736
It’s time to stop using SMS for security
By now most infosec professionals are aware of various ways SMS text messaging can be hijacked. For example so-called “SIM Swap” attacks…
3737
Facebook's GDPR consent bypass reaches Austrian Supreme Court
Austrian Supreme Court may refer case to Court of Justice, questioning the basis of Facebook's business model in Europe.
3738
The FBI Should Stop Attacking Encryption
Federal law enforcement has been asking for a backdoor to read Americans’ encrypted communications for years now. FBI Director Christopher Wray did it again last week in testimony to the Senate Judiciary Committee. As usual, the FBI’s complaints involved end-to-end encryption employed by popular...
3739
Docker Security Cheat Sheet
Website with the collection of all the cheat sheets of the project.
3740
How Git servers work, and how to keep yours secure
Disclaimer: I’m no sysadmin extraordinaire, please please please correct me if there’s something blatantly wrong here:
3741
A Spectre proof-of-concept for a Spectre-proof web
Posted by Stephen Röttger and Artur Janc, Information Security Engineers Three years ago, Spectre changed the way we think about security b...
3742
Fuzzing Java in OSS-Fuzz
Posted by Jonathan Metzman, Google Open Source Security Team OSS-Fuzz , Google’s open source fuzzing service, now supports fuzzing applicat...
3743
The security scanner that cried wolf
If you’ve ever been alarmed by how many security vulnerabilities your Docker image has, even after you’ve installed security updates, here’s what’s going on.
3744
No, RSA Is Not Broken
I have been seeing this paper by cryptographer Peter Schnorr making the rounds: “Fast Factoring Integers by SVP Algorithms.” It describes a new factoring method, and its abstract ends with the provocative sentence: “This destroys the RSA cryptosystem.” It does not. At best, it’s an improvement in factoring—and I’m not…
3745
Half of curl’s vulnerabilities are C mistakes
I spent a lot of time and effort digging up the numbers and facts for this post! Lots of people keep referring to the awesome summary put together by a friendly pseudonymous "Tim" which says that "53 out of 95" (55.7%) security flaws in curl could've been prevented if curl had been written in Rust. … Continue reading…
3746
A bug related to handling of authenticated sessions
On the evening of March 8, we invalidated all authenticated sessions on GitHub.com created prior to 12:03 UTC on March 8 out of an abundance of caution.
3747
Amazon Assistant lets Amazon track your every move on the web
Amazon Assistant browser extension delegates its wide range of privileges to Amazon web services. The potential for misuse is enormous.
3748
What science can tell us about C and C++'s security
There are not a lot of very strong empirical results in the field of programming languages . This is probably because there’s a huge amount of variables to control for, and most of the subjects available to researchers are CS undergraduates. However, I have recently found a result replicated across numerous codebases…
3749
30k U.S. organizations newly hacked via holes in Microsoft Exchange Server
At least 30,000 organizations across the United States — including a significant number of small businesses, towns, cities and local governments — have over the past few days been hacked by an unusually aggressive Chinese cyber espionage unit that’s focused on stealing email from victim organizations, multiple sources…
3750
The reason Okta spent $6.5B on Auth0
Explore the business drivers behind Okta's acquisition of Auth0, including market positioning, strategic goals, and the future of authentication providers.