421
Identify a Facebook user by his phone number despite privacy settings set
The goal of this blog is to share write-ups about bugs i have found in Facebook and reported to them under the Facebook bug bounty program.
New
The latest blog posts to take off on Hacker News. 678 posts.
422
Try This One Weird Trick Russian Hackers Hate
In a Twitter discussion last week on ransomware attacks, KrebsOnSecurity noted that virtually all ransomware strains have a built-in failsafe designed to cover the backsides of the malware purveyors: They simply will not install on a Microsoft Windows computer that already has one of many types of virtual keyboards…
423
The search for a perfect access control system
Making sense of authorization, policy and access management systems.
424
I have a lot to say about Signal’s Cellebrite hack
This blog post is based off of a talk I gave on May 12, 2021 at the Stanford Computer Science Department’s weekly lunch talk series on computer security topics. Full disclosure: I’ve done some consulting work for Signal, albeit not on anything like this issue. (I kinda doubt
425
Counter-Strike Global Offsets: reliable remote code execution
One of the factors contributing to Counter-Strike Global Offensive’s (herein “CS:GO”) massive popularity is the ability for anyone to host their own community server. These community servers are free to download and install and allow for a high grade of customization. Server administrators can create and utilize…
426
DarkSide ransomware gang quits after servers, Bitcoin stash seized
The DarkSide ransomware affiliate program responsible for the six-day outage at Colonial Pipeline this week that led to fuel shortages and price spikes across the country is running for the hills. The crime gang announced it was closing up shop after its servers were seized and someone drained the cryptocurrency from…
427
Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea
Disclaimer: Thoughts expressed here are my own, and not of my employers.
428
Privacy Update: Third-party Tracking
Read this post for a privacy update regarding third-party tracking code on our website.
429
Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
Unveiling a scheme flooding vulnerability across major browsers. Learn how it threatens anonymous browsing.
430
Ending CAPTCHAs: Introducing Cryptographic Attestation of Personhood
We want to remove CAPTCHAs completely. The idea is rather simple: a real human should be able to touch or look at their device to prove they are human, without revealing their identity. Let's explore!
431
JWT should not be your default for sessions
When designing web applications, (especially the traditional HTML kind), you will at one point have to figure out how to log a user in and keep them logged in between requests.
432
Emulating AirTags to upload arbitrary data via Apple's FindMy network
Apple AirTags: Arbitrary data can be uploaded from non-internet-connected devices by sending Find My BLE broadcasts to nearby Apple devices. We're releasing an ESP32 firmware that turns the microcontroller into an (upload only) modem, and a macOS application to retrieve, decode and display the uploaded data.
433
I could send any text message from Indian government IDs
Sometimes, you don’t necessarily need to hack a system to exploit it.
434
435
I mailed an AirTag and tracked its progress
I sent an AirTag by mail to a friend and tracked it across the UK.
436
Tracking One Year of Malicious Tor Exit Relay Activities (Part II)
>25% of the Tor network’s exit capacity has been attacking Tor users
437
Using GDPR to obtain one’s data as JSON
TL;DR: If you live in the EU or are a EU citizen, companies must provide personal data you provided or they collected in a machine-readable format, following the article 20 of the GDPR.
438
Apple Silicon Hardware: SPRR and Guarded Exception Levels (GXF)
Over a year ago siguza published a write-up about Apple’s APRR - a custom ARM extension that redefines pagetable permissions and protects certain parts of the kernel from itself. Since then Apple has released their M1 chip which not only features an updated version of APRR but also easily allows to run bare-metal code…
439
Hardening macOS (2018)
Quick and easy guide for securing macOS systems, for both laymen and security enthusiasts. Last updated for Golden Gate.
440
I Hacked Google App Engine: Anatomy of a Java Bytecode Exploit
Back in college, I was very interested in Java bytecode. When I got an internship at Google in 2013, I was skeptical of the security of the Java version of Google App Engine and got permission to spend the last week of my internship doing a mini red team exercise, trying to break into App Engine. This is the story of…
441
A future without passwords
On World Password Day, we’re providing a sneak peek at a future in which, one day, you won’t need a password at all.
442
Intent to issue €2.5M fine to Disqus over GDPR breaches
The Norwegian Data Protection Authority has notified Disqus Inc. (Disqus) that we intend to issue an administrative fine of NOK 25 000 000 for not complying with the GDPR rules on accountability, lawfulness, and transparency.
443
Why What3Words is not suitable for safety critical applications
What3Words is a widely promoted system that is used for sharing a location using just three words. For example, ///wedge.drill.mess is located in Hyde Park.The globe is divided into 3m squares, eac…
444
SeL4 on RISC-V Verified to Binary Code
… and seL4 and RISC-V Foundations form an alliance In June 2020 we announced that the seL4 microkernel, the world’s first operating system (OS) kernel with a machine-checked proof of implemen…
445
446
447
Dell patches 12-year-old driver vulnerability impacting millions of PCs
Update your Dell devices now! SentinelLabs discover five high severity flaws in Dell firmware update driver impacting desktops, laptops, notebooks & more.
448
Google banned almost 120k spam developer accounts in 2020 for the play store
Posted by Krish Vitaldevara, Director of Product Management Trust & Safety, Google Play Providing safe experiences to billions of users a...
449
Clubhouse doesn’t value privacy, security or accessibility
It is tempting to excuse Clubhouse’s flaws as growing pains, but the app’s design and rollout illustrate just how little Silicon Valley and its venture capital backers have learned.
450
