361
RCE over ham radio – Reverse shell via WinAPRS memory corruption bug
This installment will review and demonstrate functional exploits for WinAPRS on both Windows XP SP3 and Windows 10.
New
The latest blog posts to take off on Hacker News. 642 posts.
362
Dozens of high-traffic websites vulnerable to ‘account pre-hijacking’, study
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
363
How to Store an SSH Key on a Yubikey
Xe Iaso's personal website.
364
Reverse engineering Xiaomi air purifier NFC stickers
For a very thorough write-up on how this all works , please visit : https://unethical.info/2024/01/24/hacking-my-air-purifier/
365
Windows OS, Services and Apps: Network Connection Target Hosts (2021)
This post lists the internet communication targets of the Microsoft Windows operating system, including its various services and UWP apps. This post is a part of my application network connection monitoring series, a group of articles that explain how to analyze the network traffic of any Windows or macOS app.
366
GoodWill ransomware forces victims to donate to the poor
Goodwill ransomware group propagates very unusual demands in exchange for the decryption key. The Robin Hood-like group is forcing its Victims to donate to the poor and provides financial assistance to the patients in need.
367
NPM security update: Attack campaign using stolen OAuth tokens
npm's impact analysis of the attack campaign using stolen OAuth tokens and additional findings.
368
Cannoli: The Fast QEMU Tracer
Cannoli Cannoli is a high-performance tracing engine for qemu-user. It can record a trace of both PCs executed as well as memory operations. It consists of a small patch to QEMU to expose locations to inject some code directly into the JIT, a shared library which is loaded
369
What is end-to-end encryption and how does it work?
End-to-end encryption is the foundation of the Proton ecosystem. Here’s what E2EE means, and how it protects you.
370
371
HTTPS Everywhere will sunset in January 2023
You no longer need HTTPS Everywhere to set HTTPS by default! Major browsers now offer native support for an HTTPS only mode. Learn how to turn it on.Read more about the sunset of HTTPS Everywhere.Since we started offering HTTPS Everywhere, the battle to encrypt the web has made leaps and bounds....
372
Updated Proton, Unified Protection
ProtonMail is now Proton! We’re more than just encrypted email — we now offer an entire privacy-focused ecosystem of services.
373
A Kernel Hacker Meets Fuchsia OS
Fuchsia is a general-purpose open-source operating system created by Google. It is based on the Zircon microkernel written in C++ and is currently under active development. The developers say that Fuchsia is designed with a focus on security, updatability, and performance. As a Linux kernel hacker, I decided to take a…
374
Extracting TLS keys from an unwilling application (2020)
I want to be able to inspect the traffic of programs running on my computer. I don’t really trust those programs and ideally I’d like to put nearly all of them into a high security jail. One of those programs is Oculus software. There are a few reasons why I want to be cautious about Oculus software.
375
Data shows that the EU's CSAM scanning will not have the intended effect
We have analyzed telecommunication surveillance orders. Data shows that the EU's CSAM scanning is completely disproportionate and must be stopped.
376
Google open sourced PSP (hardware cryptographic offload)
We’re making the PSP Security Protocol for offloading encryption to network interface cards open source today. Here’s why.
377
Senators Urge FTC to Probe ID.me over Selfie Data
Some of more tech-savvy Democrats in the U.S. Senate are asking the Federal Trade Commission (FTC) to investigate identity-proofing company ID.me for “deceptive statements” the company and its founder allegedly made over how they handle facial recognition data collected on behalf of the Internal Revenue Service …
378
When Your Smart ID Card Reader Comes With Malware
Millions of U.S. government employees and contractors have been issued a secure smart ID card that enables physical access to buildings and controlled spaces, and provides access to government computer networks and systems at the cardholder’s appropriate security level. But many government employees aren’t issued an…
379
Bluetooth relay attacks allow Tesla Model 3 / Y to be unlocked and driven away
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
380
The end of Roe will bring about a sea change in the encryption debate
With the Supreme Court poised to rip away a constitutional right that’s been the law of the land for nearly half a century by overturning Roe v. Wade, it’s time for the gloves to come off in the encryption debate. For a quarter of a century, it has
381
Let’s Encrypt Receives the Levchin Prize for Real-World Cryptography
We are honored to be recognized for the impact on the field of cryptography.
382
Stealing checks worth millions and pwning a bank
Another long (hacker) story of mine! Once upon a time contracted to do a penetration test on a bank… I spent the better part of a week assessing every nook and cranny of the main web application. I mapped every function, and every web path, but the main website was very hardened. After spending a lot of time…
383
Liberating out-of-copyright photos from SmartFrame's DRM
During the middle of the 20th Century, the UK's Royal Air Force took thousands of photographs of the country from above. Think of it like a primitive Google Earth. Those photographs are "Crown Copyright". For photographs created before 1st June 1957, the copyright expires after 50 years. Recently, the organisation…
384
Own your calendar and contacts with OpenBSD, Baïkal, and FOSS Android
Writer for Semaphore and ButterCMS. Previously Staff Engineer at Deliveroo and in technical leadership at various public sector organisations.
385
Improved Process Isolation in Firefox 100
Firefox uses a multi-process model for additional security and stability while browsing. Web Content is rendered in separate processes.
386
EU Commission is planning automatic CSAM scanning of private communications
This would be the worst surveillance apparatus outside of China, and completely disproportionate.
387
Earn $200K by fuzzing for a weekend: Part 1
By applying well-known fuzzing techniques to a popular target, I found several bugs that in total yielded over $200K in bounties. In this article I will demonstrate how powerful fuzzing can be when applied to software which has not yet faced sufficient testing.
388
Minnesota Wants to Ban Under-18s from User-Generated Content Services
As part of an omnibus bill, the Minnesota House of Representatives passed a troubling bill restricting how under-18 users engage with user-generated content (UGC) services. [At the bottom of this post, I’ve included the text as passed by the Minnesota...
389
Android Chrome 99 expands Certificate Transparency, breaking all MitM dev tools
Certificate transparency is superb improvement to HTTPS certificate security on the web that's great for users and businesses, but on Android it creates a huge...
390