481
Bitwarden PINs can be brute-forced
Video showing bitwarden. User then sets the pin 2345. The vault is locked and then bitwarden is quit. In the terminal the exploit program is run, which after a short while outputs the PIN 2345.
New
The latest blog posts to take off on Hacker News. 617 posts.
482
Exploiting aCropalypse: Recovering truncated PNGs
This article assumes you’ve already heard about the aCropalypse vulnerability, aka CVE-2023-21036. If not, go read about it here (oops, this page doesn't exist yet. Read this tweet in the meantime).
483
484
Tracking the Fake GitHub Star Black Market
Use Dagster, dbt, and BigQuery to analyze suspicious GitHub star activity and protect open-source credibility.
485
486
What happens when your phone is spying on you
Smartphone spyware apps that allow people to spy on each other are not only hard to notice and detect, they also will easily leak the sensitive personal information they collect, says a team of computer scientists from New York and San Diego.
487
Two U.S. men charged in 2022 hacking of DEA portal
Two U.S. men have been charged with hacking into a U.S. Drug Enforcement Agency (DEA) online portal that taps into 16 different federal law enforcement databases. Both are alleged to be part of a larger criminal organization that specializes in using fake emergency data requests from compromised police and government…
488
489
Vulnerabilities in the TPM 2.0 reference implementation code
In this blog post we discuss the details of two vulnerabilities we discovered in the Trusted Platform Module (TPM) 2.0 reference implementation code. These two vulnerabilities, an out-of-bounds write (CVE-2023-1017) and an out-of-bounds read (CVE-2023-1018), affected several TPM 2.0 software implementations (such as…
490
Privatizing our digital identities
Trying to make the case for permanent irrevocable digital identities, which unfortunately today, by de-facto, are email addresses.
491
Who reads your email?
A look at diversity of MX records across all gTLDs and the Top 1M domains, indicating where SMTP is concentrated and what organizations might have broad access to the world's emails.
492
How to Yubikey
How to use and configure a Yubikey
493
The threat on your desk: Building an evil USB-C dock
BadUSB attacks have been a threat for years, but is the USB-C dock sitting on your desk the latest threat in disguise?
494
How secure is merely discarding (TRIMing) all of a SSD's blocks?
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
495
Sued by Meta, Freenom halts domain registrations
The domain name registrar Freenom , whose free domain names have long been a draw for spammers and phishers, has stopped allowing new domain name registrations. The move comes after the Dutch registrar was sued by Meta , which alleges the company ignores abuse complaints about phishing websites while monetizing…
496
Malvertising on Google Ads
Criminals are disguising malware as popular software, so users need to think twice before clicking the download button.
497
Remote Code Execution as a Service
Learn how Earthly Compute, a remote code execution as a service, was built to handle bursty workloads and provide secure and fast remote execution ...
498
Young people in 13 EU countries refuse surveillance of online communication
Poll: the 80% would not feel comfortable being politically active or exploring their sexuality if authorities can monitor their communication.
499
Norway takes a stance against Google Analytics
Norway is the latest country to declare Google Analytics in violation with the GDPR
500
501
Hacking the Nintendo DSi Browser
I managed to exploit the Nintendo DSi browser 15 years after it was released in Japan. This post will go over the journey and the technical details.
502
Live2D Is a Security Trainwreck
derailed by dangling pointers
503
Mullvad becomes highest level of Tor Member (Shallot)
Mullvad has been a Tor Project Vidalia Onion Member since 2021 and has now become a Shallot Onion Member of Tor.
504
Belgium launches nationwide safe harbor for ethical hackers
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
505
Germany opposes EU plans for client-side scanning
Germany opposes client-side scanning planned by EU - it would create an unprecedented surveillance monster that violates fundamental rights.
506
First in-the-wild UEFI bootkit bypassing UEFI Secure Boot
ESET researchers are the first to publish an analysis of BlackLotus, the first in-the-wild UEFI bootkit capable of bypassing UEFI Secure Boot.
507
I quit infosec and I couldn't be happier
This article aims at providing you some insights about the experience I had in the “infosec world” for the past few years. I had an amazing journey and grateful for everything that happened. Don’t get me wrong with the title, even if the road was sometimes “bumpy” (aka ‘bad’ experiences), I got some good lessons…
508
How SMS fraud works and how to guard against it
or why Twitter disabled SMS 2FA 💬
509
Hackers claim they breached T-Mobile more than 100 times in 2022
Three different cybercriminal groups claimed access to internal networks at communications giant T-Mobile in more than 100 separate incidents throughout 2022, new data suggests. In each case, the goal of the attackers was the same: Phish T-Mobile employees for access to internal company tools, and then convert that…
510
