361
Stealing Downloads from Slack Users
Stealing Downloads from Slack Users I’m going to go over an interesting feature abuse that could have been used to steal and even manipulate downloads from Slack users using the Slack desktop app …
New
The latest blog posts to take off on Hacker News. 579 posts.
362
Update to Security Incident
Update (May 23, 2019) : The affected 184 public network users have been notified via email.
363
Security Update
Over the weekend, there was an attack on Stack Overflow. We have confirmed that some level of production access was gained on May 11. We discovered and investigated the extent of the access and are addressing all known vulnerabilities. We have not identified any breach of customer or user data. Our customers’ and…
364
365
ELF files on Linux
An step-by-step introduction into ELF files. Learn the structure and format, to understand how binaries and libraries on Linux systems work.
366
EFF Wins National Security Letter Transparency Lawsuit
A federal district court in San Francisco has ruled strongly in favor of our Freedom of Information Act lawsuit seeking records of how and when the FBI lifts gag orders issued with National Security Letters (NSLs). These records will provide a window into the FBI’s use of a highly secretive...
367
GKE Sandbox: Independent operating system kernel to each container
Help lock down your containers with these Kubernetes Engine features and guidance
368
Oak, a Free and Open Certificate Transparency Log
Update: Feb. 5 2020 The Let’s Encrypt CT logs are now included in approved log lists and are usable by all publicly-trusted certificate authorities. Today we are announcing a new Certificate Transparency log called Oak. The Oak log will be operated by Let’s Encrypt and all publicly trusted certificate authorities will…
369
Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003
Microsoft today is taking the unusual step of releasing security updates for unsupported but still widely-used Windows operating systems like XP and Windows 2003 , citing the discovery of a “wormable” flaw that the company says could be used to fuel a fast-moving malware threat like the WannaCry ransomware attacks of…
370
Git ransom campaign incident report
This is a coordinated effort to help educate and inform users on secure best practices relating to the recent Git ransomware incident.
371
372
China is blocking all language editions of Wikipedia
translation: 中国封锁了所有语言版本的维基百科 China recently started blocking all language editions of Wikipedia. Previously, the blocking was limited to the Chinese language edition of Wikipedia (zh.wikipedia.org), but has now expanded to include all *.wikipedia.org language editions. In this post, we share OONI network measurement…
373
Senate Testimony on Privacy Rights and Data Collection in a Digital Economy
Idle Words > Talks > Privacy Rights and Data Collection in a Digital Economy (Senate hearing)
374
375
The Origin of ‘Script Kiddie’
The term script kiddie probably originated around 1994, but the first public record is from 1996.
376
‘eyeDisk’ USB drive secured with iris recognition reveals password in plain text
Last year, about the time we were messing around with a virtually unheard-of hardware wallet we got a bit excited about the word “unhackable”. Long story short, I ended up supporting a selection of kickstarters that had the word “unhackable” or similar in their title. Of these, at least one got funded and got…
377
Adventures in WhatsApp DB – extracting messages from backups, with code examples
Getting your messages without giving a third party your credentials and data
378
Open source firmware is important for security
Why open source firmware is important for security.
379
Post-mortem and remediations for the Matrix.org security breach
Matrix, the open protocol for secure decentralised communications
380
Improving privacy and security on the web
In 2008, we launched Chrome with the goal of building a speedy, simple, secure and stable web for everyone, everywhere. Ten years later, use...
381
Cybersecurity Checklist for Political Campaigns
Short-lived political campaigns rarely build formal security programs and often assume they're too small to attract serious attackers, but campaigns across the United States have been targeted by document theft and credential phishing. Six observed attacker tactics map to a short list of defensive priorities, starting…
382
ProtonMail is dropping support for Internet Explorer 11
If you still use Internet Explorer, you will need to switch to a more secure, modern web browser to access Proton Mail.
383
Google AdWords Exploit Seen in the Wild
See the ad for ebay at the top of the results? Not particularly interesting, right?…
384
WordPress 5.2: Mitigating Supply-Chain Attacks
We wrote a cryptography library entirely in PHP to make your WordPress site secure against supply-chain attacks.
385
Protecting democratic elections through secure, verifiable voting
Today, at the Microsoft Build developer conference, CEO Satya Nadella announced ElectionGuard, a free open-source software development kit (SDK) from our Defending Democracy Program. ElectionGuard will make voting secure, more accessible, and more efficient anywhere it’s used in the United States or in democratic…
386
Modeling Adversaries with TLA+
A common question I get about specs is how to model bad actors. Usually this is one of two contexts: The spec involves several interacting agents sharing a protocol, but some of the nodes are faulty or malicious: they will intentionally try to subvert the system. The spec involves an agent subject to outside forces…
387
Repositories held for ransom by using valid credentials
We’ve learned of suspicious Git activity on GitLab. Affected users have been notified.
388
Reverse Engineering a Xinjiang Police Mass Surveillance App
This report presents new evidence about the surveillance state in Xinjiang, where the government has subjected 13 million Turkic Muslims to heightened repression as part of its “Strike Hard Campaign against Violent Terrorism.” Between January 2018 and February 2019, Human Rights Watch was able to reverse engineer the…
389
Android App Reverse Engineering 101
Learn to reverse engineer Android applications!
390
Writing Exploit-Resistant Code with OpenBSD
On April 27, 2019, I gave a talk on how to use OpenBSD to write better software at CarolinaCon 15 in Charlotte.