391
Mozilla SOPS with KMS and Git is underrated (2019)
Hashicorp Vault hogs the limelight as cost-effective powerful KMS solutions are hidden in plain sight. Click here to explore Mozilla SOPS.
New
The latest blog posts to take off on Hacker News. 612 posts.
392
Millions of email addresses leaking to advertising and analytics companies
Breaches have been found on websites including Wish.com, JetBlue.com, Quibi.com, WashingtonPost.com, NGPVan.com and numerous other…
393
SSH hacks – a little sanity for remote workers
A few of our favorite SSH tricks and tips sure to improve your daily experience.
394
Mac sandbox escape
This blog post discloses a sandbox escape on macOS. I reported the issue to Apple Product Security on December 19 2019, the day the Apple Security Bounty program finally opened. (I discovered the issue in August 2019.) Today I received an email from Apple Product Security saying "we do not see any actual security…
395
De-Googling: My Progress
I wrote a bit about my reasoning to De-Google here . Now I want to write a bit about my progress, the struggles and what I ended up with.
396
Would You Have Fallen for This Phone Scam?
You may have heard that today’s phone fraudsters like to use caller ID spoofing services to make their scam calls seem more believable. But you probably didn’t know that these fraudsters also can use caller ID spoofing to trick your bank into giving up information about recent transactions on your account — data that…
397
With questionable copyright claim, Jay-Z orders deepfake parodies off YouTube
With a questionable claim to copyright, Jay-Z ordered two deepfake audio parodies of his voice off YouTube. I talked to the video's creator about the future of AI for creative expression.
398
At least 11 cities use automated surveillance in the EU
At least 11 local police forces in Europe use computer vision to automatically analyze images from surveillance cameras. The risks of discrimination run high but authorities ignore them.
399
Beware of the GIF: Account Takeover Vulnerability in Microsoft Teams
Protect your organization with Idira®. Modernize identity governance, automate access reviews, and secure every identity across your hybrid cloud environment.
400
How does a TCP Reset Attack work?
A TCP reset attack is executed using a single packet of data, no more than a few bytes in size. A spoofed TCP segment, crafted and sent by an attacker, tricks two victims into abandoning a TCP connection, interrupting possibly vital communications between them.
401
Mastering systemd: Securing and sandboxing applications and services
This series of articles will explore some of my favorite Red Hat Enterprise Linux (RHEL) 8 capabilities that are enabled by systemd. Thus, this series assume...
402
How to break everything by fuzz testing
Fuzz testing is a bit like the infinite monkey theorem, but instead of Shakespeare you get crashes.
403
Vietnam's contact tracing app broadcasting a fixed ID
Prologue Bluezone ( Android , iOS ) is a Bluetooth-based contact tracing app sponsored by the Government of Vietnam and developed by a c...
404
An Android 8.0-9.0 Bluetooth Zero-Click RCE
Nowadays, Bluetooth is an integral part of mobile devices. Smartphones interconnect with smartwatches and wireless headphones. By default, most devices are configured to accept Bluetooth connections from any nearby unauthenticated device. Bluetooth packets are processed by the Bluetooth chip (also called a…
405
Analyzing Analytics (Featuring: The FBI)
Recently while conducting some research, I found myself down the path of Google Analytics ID's as well as other analytics services. I was investigating ways to not only identify varying analytics code in sites, but to correlate them with ot…
406
When in doubt: hang up, look up, and call back
Many security-conscious people probably think they’d never fall for a phone-based phishing scam. But if your response to such a scam involves anything other than hanging up and calling back the entity that claims to be calling, you may be in for a rude awakening. Here’s how one security and tech-savvy reader got taken…
407
The ProtonMail Android app is now open source
Our Proton Mail Android app is open source. We are committed to transparency and contributing to the open source and privacy tech community.
408
Increasing transparency through advertiser identity verification
Our goal is to ensure users understand who is advertising to them and why they are seeing specific ads.
409
What end-to-end encryption should look like
Check out our progress in end-to-end encryption calls in Jitsi. Give us your crypto knowledge feedback with the code and learn how to demo it here.
410
What a one line change did to the Chrome sandbox
Posted by James Forshaw, Project ZeroThe Chromium sandbox on Windows has stood the test of time. ...
411
You’ve Got 0-Click Mail: Unassisted iOS Attacks RCE via Mobilemail/Maild
October is Cybersecurity Awareness Month! How is your cybersecurity practice going?
412
413
Stripe records user movements on its customers' websites
An investigation into how Stripe tracks your users and what you can do to prevent it
414
An important safety note about chown and symlinks (also chmod and chgrp)
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
415
416
Netflix now supports TLS 1.3
By Sekwon Choi
417
Who’s behind the “reopen” domain surge?
The past few weeks have seen a large number of new domain registrations beginning with the word “reopen” and ending with U.S. city or state names. The largest number of them were created just hours after President Trump sent a series of all-caps tweets urging citizens to “liberate” themselves from new gun control…
418
A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs
Maik Ender and Amir Moradi, Horst Goertz Institute for IT Security, Ruhr University Bochum, Germany; Christof Paar, Max Planck Institute for Cyber Security and Privacy and Horst Goertz Institute for IT Security, Ruhr University Bochum, Germany
419
Google Apple Contact Tracing (GACT): a wolf in sheep’s clothes?
I wrote a critical piece about the Google Apple Contact Tracing (GACT) platform a few days ago . This resulted in quite some discussion, which brought some more arguments to the fore, that I would like to address and clarify here. Here I focus on my area of expertise: privacy. My colleague Tamar Sharon wrote an…
420
Demolishing Wallhacks with VALORANT's Fog of War
From the very beginning of VALORANT development, we made it a priority to build out cheating resistance to ensure competitive integrity. In this article, I’ll walk you through one of these anti-cheat systems - Fog of War. This…