61
Chrome client “variations” can be used to identify you (2020)
Until now I used Chrome with a few settings tweak like disabling sending usage statistics, uBlock origin, no crash reports and so on.
New
The latest blog posts to take off on Hacker News. 678 posts.
62
The Fraud Supply Chain
Fraud is largely conducted by professionals operating in specialized firms, which have their own ecosystem of evil.
63
Germany: New government plans 'right to encryption'
The coalition contract of the newly elected German government contains right to encryption.
64
Microsoft Windows RCE Vulnerability Gives an Attacker Complete Control
Synack Red Team breaks down a Windows RCE vulnerability enabling full remote code execution and complete attacker control — exploitation techniques and real-world security analysis.
65
Testing Phone-Sized Faraday Bags
Complex software is, to put it mildly, hard to get right (for details, see almost any other posting on this or any other security blog). Especially for gadgets that are rich with microphones, cameras, location and environmental sensors, and communication links (such as, you know, smartphones), errors and security…
66
Chrome phasing out Manifest v2 support from Jan 2022
Details of the Manifest V2 phase-out and end of life.
67
This shouldn't have happened: A vulnerability postmortem
Posted by Tavis Ormandy, Project Zero Introduction This is an unusual blog post. I normally wri...
68
Texas woman wins round in lawsuit challenging swat teams destruction of her home
ARLINGTON, Va.—On Thursday, a federal judge ruled that a lawsuit filed by a Texas woman whose home was destroyed by a SWAT team may move […]
69
An Illustrated Guide to Elliptic Curve Cryptography Validation
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
70
71
The case of the recursive resolvers: What happened during Slack’s DNSSEC rollout
On September 30th 2021, Slack had an outage that impacted less than 1% of our online user base, and lasted for 24 hours. This outage was the result of our attempt to enable DNSSEC — an extension intended to secure the DNS protocol, required for FedRAMP Moderate — but which ultimately led to a series of…
72
No U PNP
Previously on Deep Space Nine, we discussed (read: I complained about) the short life and quick death of DLNA. On the way, I mentioned DLNA's dependence on UPnP as an underlying autoconfiguration protocol. Let's talk a bit more about UPnP, because it's 1) an interesting protocol, 2) widely misunderstood, and 3)…
73
The internet is held together with spit and baling wire
A visualization of the Internet made using network routing data. Image: Barrett Lyon, opte.org.
74
75
Multi-Account Containers to “Exchange messages with programs other than Firefox”
A new version of Firefox Multi-Account Containers requires permission to “Exchange messages with programs other than Firefox.”
76
Vulnerabilities in chips in 37% of smartphones
Highlights Check Point Research discovered vulnerabilities in MediaTek’s chips, embedded in 37% of all smartphones globally CPR discovered several %
77
New differential fuzzing tool reveals novel HTTP request smuggling techniques
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
78
New German government calls for European ban on biometric mass surveillance
The newly-agreed German government coalition has called for a Europe-wide ban on public facial recognition and other biometric surveillance. This echoes the core demands of the Reclaim Your Face campaign which EDRi has co-led since 2020, through which over 65 civil society groups ask the EU and their national…
79
80
Apple sues NSO Group to curb the abuse of state-sponsored spyware
Apple today filed a lawsuit against NSO Group to hold it accountable for abusive surveillance and the targeting of a small number of Apple users.
81
82
SugarCoat: Private browsing without breaking the web
A team of computer scientists at the University of California San Diego and Brave Software. have developed a tool that will increase protections for users’ private data while they browse the web.
83
84
Fingerprints can be hacked
Fingerprint authentication is a convenient alternative to passwords and PIN codes. Who wants to spend time typing in a lengthy string of numbers, letters and characters when a simple tap will suffice? Unfortunately, that convenience comes at a cost. Because, unlike a regular password, you leave your fingerprint on…
85
What every IT person needs to know about OpenBSD Part 3: That packet filter
Useful and fun features related to the OpenBSD packet filter.
86
Is Microsoft Stealing People’s Bookmarks?
I received email from two people who told me that Microsoft Edge enabled synching without warning or consent, which means that Microsoft sucked up all of their bookmarks. Of course they can turn synching off, but it’s too late. Has this happened to anyone else, or was this user error of some sort? If this is real, can…
87
ChaosDB Explained: Azure's Cosmos DB Vulnerability Walkthrough
This is the full story of the Azure ChaosDB Vulnerability that was discovered and disclosed by the Wiz Research Team, where we were able to gain complete unrestricted access to the databases of several thousand Microsoft Azure customers.
88
The ‘Zelle fraud’ scam: how it works, how to fight back
One of the more common ways cybercriminals cash out access to bank accounts involves draining the victim’s funds via Zelle , a “peer-to-peer” (P2P) payment service used by many financial institutions that allows customers to quickly send cash to friends and family. Naturally, a great deal of phishing schemes that…
89
Backdooring Rust crates for fun and profit
Supply chains attacks are all the rage these days, whether to deliver RATs, cryptocurrencies miners, or credential stealers. In Rust, packages are called crates and are (most of the time) hosted on a central repository: https://crates.io for better discoverability. We are going to study 8 techniques to achieve Remote…
90
How we protect our most sensitive secrets from the most determined attackers
As a bank, we have a lot of secrets we need to protect to keep our customers and ourselves safe. These include private keys that only we know, which we use to digitally sign requests as coming from us (sort of like a private password). These private keys are super important and are used all over Monzo and when…