661
Stealing Your Private YouTube Videos, One Frame at a Time
David Schütz's bug bounty writeups
New
The latest blog posts to take off on Hacker News. 678 posts.
662
The Most Backdoor-Looking Bug I’ve Ever Seen
This is the story of a bug that was discovered and fixed in Telegram’s self-rolled cryptographic protocol about seven years ago. The bug didn’t get any press, and no one seems to know about it, probably because it was only published in Russian.
663
664
665
Best of show – abuse of libc
printf machine. 2020 IOCCC entry carlini - Best of Show - abuse of libc
666
An Update on SolarWinds
We’d like to provide a further update to our customers in regards to the SolarWinds breach. At this point we reiterate the message we posted yesterday – we have not played any role in this breach, nor are we aware of any vulnerabilities in TeamCity that may have led to this breach, as we are also not aware of any…
667
Victory at the High Court against the government’s use of 'general warrants’
Today, the UK High Court has quashed a decision by the Investigatory Powers Tribunal (IPT), and ruled that section 5 of the Intelligence Services Act (ISA) 1994 does not permit the issuing of general warrants to authorise property interference and certain forms of computer hacking.
668
Sealed U.S. Court Records Exposed in SolarWinds Breach
The ongoing breach affecting thousands of organizations that relied on backdoored products by network software firm SolarWinds may have jeopardized the privacy of countless sealed court documents on file with the U.S. federal court system, according to a memo released Wednesday by the Administrative Office (AO) of the…
669
CVE-2021-3011: Key recovery on Google Titan Key
Download the Writeup Illustration made by Romain Flamand Abstract The Google Titan Security Key is a FIDO U2F hardware device proposed by Google (available since July 2018) as a two-factor authentication token to sign in to applications (e.g. your Google account). Our work describes a side-channel attack that targets…
670
Encrypted Client Hello: The Future of ESNI in Firefox
Background Two years ago, we announced experimental support for the privacy-protecting Encrypted Server Name Indication (ESNI) extension in Firefox Nightly. The Server Name Indication (SNI) TLS extension enables server and ...
671
672
Simulating the PIN cracking scene in Terminator 2
In the beginning of Terminator 2: Judgement Day, John Connor uses a laptop to crack the PIN of a stolen debit card.
673
EFF to FinCEN: Stop Pushing for More Financial Surveillance
Today, EFF submitted comments to the Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) opposing the agency’s proposal for new regulations of cryptocurrency transactions. As we explain in our comments, financial records can be deeply personal and revealing, containing a...
674
675
Look Up Unknown Phone Numbers Using Facebook Reset Password
This tutorial is meant to help find clues as to who is calling you when you're receiving calls from an unknown phone number (a number that is displayed on
676
URL shorteners set ad tracking cookies
This Christmas, a family member sent me a URL to a family Zoom call. However, they didn’t send me a direct link to Zoom. Instead, they sent me a
677
Encrypted Backup Shootout
Recently I have been spending time on improving the performance of bupstash (my encrypted backup tool), and wanted to compare it to some existing tools to try and find its relative performance in the backup tool landscape.
678
CVE Stuffing
I monitor the @CVENew Twitter feed to keep up with any interesting new vulnerabilities that are released. On December 11th CVE-2020-29589 was published claiming that “the kapacitor Docker ima…