5881
Targeting HTTP's Hidden Attack-Surface
Modern websites are browsed through a lens of transparent systems built to enhance performance, extract analytics and supply numerous additional services. This almost invisible attack surface has been
New
The latest blog posts to take off on Hacker News. 8,772 posts.
5882
5883
How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security
How Chrome OS, Termux, YubiKey & Duo Mobile make for great usable security. A travel Chromebook for modern development, online and offline.
5884
Remotely Compromising Android and iOS via a bug in Broadcom's WI-FI Chipsets
Author: Nitay Artenstein Introduction Fully remote exploits that allow for compromise of a target without any user interaction have become something of a myth in recent years. While some are occasionally still found against insecure and unpatched targets such as routers, various IoT devices or old versions of Windows…
5885
Announcing the Windows Bounty Program
Windows 10 represents the best and newest in our strong commitment to security with world-class mitigations. One of Microsoft’s longstanding strategies toward improving software security involves investing in defensive technologies that make it difficult and costly for attackers to find, exploit and leverage…
5886
Breaking open the Mt. Gox case, part 1
The official blog of WizSec, a group of bitcoin security specialists, and their investigation into MtGox.
5887
Firefox Roadmap for Flash End-Of-Life
This morning, Adobe announced its roadmap to stop supporting Flash at the end of 2020. Working with Adobe and other browser vendors, Mozilla has prepared a roadmap for Flash support ...
5888
Passwords Evolved: Authentication Guidance for the Modern Era
In the beginning, things were simple: you had two strings (a username and a password) and if someone knew both of them, they could log in. Easy. But the ecosystem in which they were used was simple too, for example in MIT's Time-Sharing Computer [https://www.wired.com/
5889
A Guide to Synthesizing Adversarial Examples
Synthesizing adversarial examples for neural networks is surprisingly easy.
5890
Trust Issues: Exploiting TrustZone TEEs
Posted by Gal Beniamini, Project ZeroMobile devices are becoming an increasingly privacy-sensitiv...
5891
5892
5893
5894
5895
5896
Zigfrid – A Passive RFID Fuzzer
Zigfrid is the end result of my RFID tinkering. Since I will most definitely forget most things described here in the (very) near future, I share this for those few who might find it interesting. P…
5897
5898
On Password Managers
It has come to my attention that people are Wrong On The Internet about password managers. This matters, because almost everybody should be using one. Herewith background, opinions, and a description of my own setup, which is reasonably secure.
5899
How I Tricked Symantec with a Fake Private Key
This blog is written by Hanno Böck. Unless noted otherwise, its content is licensed as CC0 .
5900
5901
On the Perceived Value of EV Certs, Commercial CAs, Phishing and Let's Encrypt
Last week I wrote about how Life Is About to Get a Whole Lot Harder for Websites Without HTTPS [https://www.troyhunt.com/life-is-about-to-get-harder-for-websites-without-https/]. Somewhere in the comments there, the discussion went off on a tangent about commercial CAs, the threat
5902
Android Backdoor GhostCtrl Can Silently Record Your Audio, Video, and More
The RETADUP worm that affected Israeli hospitals turned out have bigger impact than we first thought. It was accompanied by an even more dangerous threat: an Android malware that can take over the device. We’ve named this Android backdoor GhostCtrl.
5903
5904
Robust Adversarial Examples
Stay up to speed on the rapid advancement of AI technology and the benefits it offers to humanity.
5905
Myspace lets you hijack any account just by knowing the person’s birthday
In April this year whilst roaming the plains of the wild world web, I stumbled across an old Myspace account of mine. Attempting to gain access and delete the account I discovered a business process so flawed it deserves its own place in history. I wrote to Myspace describing my
5906
Formal verification of the WireGuard protocol
WireGuard has undergone all sorts of formal verification, covering aspects of the cryptography, protocol, and implementation. Below details the various efforts.
5907
I cannot consistently write safe C/C++ code
Robert O'Callahan. Christian. Kiwi. Software guy. All content human-authored unless otherwise noted.
5908
Beyond public key encryption
One of the saddest and most fascinating things about applied cryptography is how little cryptography we actually use. This is not to say that cryptography isn’t widely used in industry —…
5909
Australian PM Calls for End-To-End Encryption Ban
"The laws of mathematics are very commendable but the only law that applies in Australia is the law of Australia", said Australian Prime Minister Malcolm Turnbull today. He has been rightly mocked for this nonsense claim, that foreshadows moves to require online messaging providers to provide law...
5910