451
A Cryptographic Near Miss
A recent issue in scalar multiplication makes for a good case study of how unsafe interfaces, undocumented assumptions, and time lead to vulnerabilities.
New
The latest blog posts to take off on Hacker News. 617 posts.
452
453
Reverse Engineering the Facebook Messenger API
Note: The focus of this article is to explain the process of reverse engineering, and it is not continually updated to reflect ongoing changes in Facebook APIs. If you are looking for updated details, consider basing your work on open-source projects like mautrix/meta , which is developed by my employer Beeper .
454
What happens when you leak AWS credentials and how AWS minimizes the damage
I heard multiple times that AWS scans public GitHub repositories for AWS credentials and informs its users of the leaked credentials.
455
The Bitcoin whitepaper is hidden in every copy of macOS
I just discovered that every copy of macOS ships with a hidden PDF of Satoshi Nakamoto's Bitcoin whitepaper. But why?
456
Seized Genesis Market data is now searchable in Have I Been Pwned
A quick summary first before the details: This week, the FBI in cooperation with international law enforcement partners took down a notorious marketplace trading in stolen identity data in an effort they've named "Operation Cookie Monster". They've provided millions of impacted email addresses and passwords to Have I
457
CAN Injection: Keyless car theft
This is a detective story about how a car was stolen - and how it uncovered an epidemic of high-tech car theft. It begins with a tweet. In April 2022, my friend Ian Tabor tweeted that vandals had been at his car, pulling apart the headlight and unplugging the cables.
458
FBI seizes bot shop ‘Genesis Market’ amid arrests targeting operators, suppliers
Several domain names tied to Genesis Market , a bustling cybercrime store that sold access to passwords and other data stolen from millions of computers infected with malicious software, were seized by the Federal Bureau of Investigation (FBI) today. The domain seizures coincided with more than a hundred arrests in…
459
Was there a U.S. nuclear weapons accident at a Dutch air base?
A photo in a Los Alamos National Laboratory (LANL) student briefing from 2022 shows four people inspecting what appears to be a damaged B61 nuclear bomb.
460
German police raid DDoS-friendly host FlyHosting
Authorities in Germany this week seized Internet servers that powered FlyHosting , a dark web offering that catered to cybercriminals operating DDoS-for-hire services, KrebsOnSecurity has learned. FlyHosting first advertised on cybercrime forums in November 2022, saying it was a Germany-based hosting firm that was…
461
The undocumented Android change that led to aCropalypse was reported during beta
The bug lies in closed-source Google-proprietary code so it’s a bit hard to inspect, but after some patch-diffing I concluded that the root cause was due to this horrible bit of API ‘design’: https://issuetracker.google.com/issues/180526528 .
462
Germany opposes client-side scanning planned by EU
Germany opposes client-side scanning planned by EU - it would create an unprecedented surveillance monster that violates fundamental rights.
463
464
AAD misconfiguration led to Bing.com results manipulation, account takeover
How Wiz Research found a common misconfiguration in Azure Active Directory that compromised multiple Microsoft applications, including a Bing management portal
465
Spyware vendors use 0-days and n-days against Android, iOS and Chrome
Google’s Threat Analysis Group (TAG) tracks actors involved in information operations (IO), government backed attacks and financially motivated abuse. For years, TAG has…
466
Messaging layer security: Secure and usable end-to-end encryption
The IETF has approved publication of Messaging Layer Security (MLS), a new standard for end-to-end security that will make it easy for apps to provide the highest level of security to their users. End-to-end encryption is an increasingly important security feature in Internet applications. It keeps users’ information…
467
468
EU Commission doesn't understand what's written in its own chat control bill
Ylva Johansson is the EU Commissioner in charge of the Chat Control Bill. In recent days she has taken part in several interviews in Swedish media and also spoken in front of EU parliament members.
469
UK sets up fake booter sites to muddy DDoS market
The United Kingdom’s National Crime Agency (NCA) has been busy setting up phony DDoS-for-hire websites that seek to collect information on users, remind them that launching DDoS attacks is illegal, and generally increase the level of paranoia for people looking to hire such services.
470
Apple passwords deserve an app
First, let’s consider three random tweets: They already have. They definitely should. They seemingly won’t… but why? We all know that Apple has nice built-in password management in macO…
471
The chat control proposal does not belong in democratic societies
The European Commission is working on a legislative proposal called chat control. If the law goes into effect, all EU citizens will have their communications monitored and audited. Now is the time to stop it.
472
473
Dismantling a Crappy Malware Operation
Dismantling a Shoddy Malware Operation The Discovery I had been made aware of a malware spreading site called obspremium.com. This site is claiming to offer a so-called “premium” version of the popular open source recording and streaming program Open Broadcaster Software at obsproject.com. “OBS Premium” hosts a direct…
474
Reliability via Automated Renewal Information
The Let’s Encrypt team is excited to announce that ACME Renewal Information (ARI) is live in production! ARI makes it possible for our subscribers to handle certificate revocation and renewal as easily and automatically as the process of getting a certificate in the first place. With ARI, Let’s Encrypt can signal to…
475
We updated our RSA SSH host key
At approximately 05:00 UTC on March 24, out of an abundance of caution, we replaced our RSA SSH host key used to secure Git operations for GitHub.com.
476
Block: Inflated user metrics and “frictionless” fraud facilitation
Initial Disclosure: After extensive research, we have taken a short position in shares of Block, Inc. (NYSE: SQ). This report represents our opinion, and we encourage every reader to do their own due diligence. Please see our full disclaimer at the bottom of the report.
477
Chinese app included malware to gain competitive advantage
Google says it has suspended the app for the Chinese e-commerce giant Pinduoduo after malware was found in versions of the software. The move comes just weeks after Chinese security researchers published an analysis suggesting the popular e-commerce app sought to seize total control over affected devices by exploiting…
478
Web fingerprinting is worse than I thought
Explore top no verification casino sites in Australia offering instant crypto withdrawals, huge pokies libraries, and safe anonymous gambling.
479
480
Supreme Court asked to strike down immunity for police who brutally beat student
ARLINGTON, Va.—A new cert petition before the United States Supreme Court asks the Justices to strike down an immunity recognized by a lower court for […]