421
New
The latest blog posts to take off on Hacker News. 536 posts.
422
Passkeys – Under the Hood
The Latest News from Research at Kudelski Security
423
Reverse engineering a car key fob signal
I’ve had the curiosity to explore radio communication protocols for a few years now, ever since I’ve started fiddling around with an RTL-SDR dongle. I always had the goal of figuring out how data is transmitted in remote controls (car key fobs particularly), trying replay attacks, and other possible attack vectors.
424
425
On the new Dutch intelligence and security law
13th of June UPDATE: The Dutch government has failed to hire and house the promised new 10 oversight staff. Yet, the new law will be enacted July 1st, passing oversight to people that don’t exist. I surely enjoyed living under the rule of law, but it appears it was a passing thing. “The Netherlands hosts some of the…
426
C++ Safety, in Context
Scope. To talk about C++’s current safety problems and solutions well, I need to include the context of the broad landscape of security and safety threats facing all software. I chair the ISO C++ s…
427
Google's threat model for post-quantum cryptography
Read on to understand how Google currently evaluates the threat landscape related to post-quantum cryptography, and what implications this has for migrating from classical cryptographic algorithms to PQC.
428
429
How the Devteam Conquered the iPhone
The summer of 2007 was an eventful one if you were into cell phones. It all started on June 29 when Apple announced the release of the iPhone. If you have never taken the time to watch the full keynote, I highly recommend it.
430
Reverse Engineering Protobuf Definitions from Compiled Binaries
How to extract raw source protobuf definitions from compiled binaries, regardless of the target architecture
431
Bypassing Safari 17's advanced audio fingerprinting protection
Explore how Safari 17’s new anti-fingerprinting techniques affect audio fingerprinting and browser differentiation.
432
Using LLMs to Generate Fuzzers
LLMs seem surprisingly good at many things. So much so that not a week goes by without someone coming up with yet another use-case for this technology, often to solve tasks quickly that traditionally took a non-trivial amount of human work to complete. Today’s example was Brendan Dolan-Gavitt’s remarkable experiment…
433
Apple curl security incident 12604
tldr: Apple thinks it is fine. I do not. On December 28 2023, bugreport 12604 was filed in the curl issue tracker. We get a lot issues filed most days so this fact alone was hardly anything out of the ordinary. We read the reports, investigate, ask follow-up questions to see what we can learn … Continue reading the…
434
You cannot simply publicly access private secure links, can you?
turns out, you can even search for them with powerful search engines!
435
Making messaging interoperability with third parties safe for users in Europe
To comply with a new EU law, the Digital Markets Act (DMA), which comes into force on March 7th, we’ve made major changes to WhatsApp and Messenger to enable interoperability with third-party messa…
436
ECJ finds IAB Europe responsible for TCF consent spam popups across the Internet
Europe's top court rules that IAB Europe is responsible under the GDPR for the "TCF" consent system, which authorities have already found to be in violation of the GDPR.
437
We hacked Google A.I.
Bard IDOR, a GraphQL directive-overloading DoS that hung Google's backend for 109 seconds, and Workspace data exfiltration via markdown images.
438
Network Tunneling with QEMU
While investigating an incident, we detected uncommon malicious activity inside one of the systems. We ran an analysis on the artifacts, only to find that the adversary had deployed and launched the QEMU hardware emulator.
439
BlackCat ransomware group implodes after apparent payment by Change Healthcare
There are indications that U.S. healthcare giant Change Healthcare has made a $22 million extortion payment to the infamous BlackCat ransomware group (a.k.a. “ ALPHV “) as the company struggles to bring services back online amid a cyberattack that has disrupted prescription drug services nationwide for weeks. However…
440
A Bug in Early Creative Commons Licenses Has Enabled Copyleft Trolls (2022)
Copyleft trolls, robosigning, and Pixsy.
441
Cracking Meta's Messenger Certificate Pinning on macOS
Bypassing certificate pinning in Meta’s Messenger application on macOS.
442
New ways we're tackling spammy, low-quality content on Search
We’re making updates to show less unoriginal, low-quality content on Search.
443
Cloudflare Announces Firewall for AI
Cloudflare is one of the first providers to safeguard LLM models and users in the era of AI
444
ShotSpotter: listening in on the neighborhood
Last week, someone leaked a spreadsheet of SoundThinking sensors to Wired . You are probably asking "What is SoundThinking," because the company rebranded last year. They used to be called ShotSpotter, and their outdoor acoustic gunfire detection system still goes by the ShotSpotter name.
445
446
How we applied fuzzing techniques to cURL
Near the end of 2022, Trail of Bits was hired by the Open Source Technology Improvement Fund (OSTIF) to perform a security assessment of the cURL file transfer command-line utility and its library, libcurl. The scope of our engagement included a code review, a threat model, and the subject of this blog […]
447
Over 100k Infected Repos Found on GitHub
Secure everything coding agents build, use, and ship - prevent risk before code exists, AutoFix the backlog, and protect the coding agents and supply chain.
448
Why I use Firefox
I’m interested in HTML, CSS, and making the web less annoying
449
The /unblock API from Browserless: dodging bot detection as a service
The /unblock API clears away bot fingerprints at the CDP level, to truly humanize your Puppeteer automations.
450
