91
Chrome 0-day exploit used in Operation WizardOpium
Recently, we caught a new unknown exploit for Chrome browser. After reviewing of the PoC we provided, Google confirmed there was a zero-day vulnerability and assigned it CVE-2019-13720.
New
The latest blog posts to take off on Hacker News. 579 posts.
92
Setting up a home VPN server with WireGuard
Motivation For a moderately security conscious geek like myself, there can be a number of reasons to want to set up a home VPN server: Accessing your home computer via screen sharing without exposing it to the Internet (and thereby to potential evil-doers). Accessing servers with IP white lists (common case for…
93
DKIM Demystified
DKIM is a way to secure your email, increasing deliverability and avoiding fraud. A 20i Senior Systems Administrator explains DKIM in depth.
94
Destroying x86_64 instruction decoders with differential fuzzing
TL;DR: x86_64 decoding is hard, and the number and variety of implementations available for it makes it uniquely suited to differential fuzzing. We’re open sourcing mishegos, a differential fuzzer for instruction decoders. You can use it to discover discrepancies in your own decoders and analysis tools! In the…
95
Getting Started with Security Keys
How to stay safe online and prevent phishing with FIDO2, WebAuthn and security keys. A look into YubiKeys, TOTP authenticator apps, passwordless and more.
96
ProtonMail iOS app goes open source
We have released the Proton Mail iOS app as open source software as part of our commitment to transparency and supporting the developer community.
97
Xfinity Is Man-in-the-Middle Attacking My Internet
Xfinity injected 581 lines of JavaScript into unencrypted traffic as a data-cap warning, creating MITM risks, accessibility failures, and slower loads.
98
Mass cellphone surveillance experiment in Spain
Spanish Statistics Institute will track all cellphones for eight days (2 min, link in Spanish, via) A few facts first: Carriers geotrack all users by default, using cell tower triangulation. They also store logs of your calls and sms, but that is
99
100
101
7M Adobe Creative Cloud Accounts Exposed to the Public
A data exposure of 7 million Adobe Creative Cloud account records could put users at risk of targeted phishing.
102
Tor Browser 9.0
We want everyone in the world to be able to enjoy the privacy and freedom online Tor provides, and that's why over the past couple years, we've been working hard to boost our UX and localization efforts, with the biggest gains first visible in Tor Browser 8.0. In Tor Browser 9.0, we continue to build upon those…
103
Why EdDSA held up better than ECDSA against Minerva
"Minerva attack can recover private keys from smart cards, cryptographic libraries" , says the ZDNet headline. "The Czech team found a problem in the ECDSA and EdDSA algorithms used by the Atmel Toolbox crypto library to sign cryptographic operations on Athena IDProtect cards."
104
105
Get Ready for New SameSite=None; Secure Cookie Settings
UPDATE (10/28/2019): We've revised the 2nd and 3rd bullet points in the section "How to Prepare; Known Complexities" below. In May, Chrome ...
106
An Intern's Experience with Rust
Over the course of my internship at the Microsoft Security Response Center (MSRC), I worked on the safe systems programming languages (SSPL) team to promote safer languages for systems programming where runtime overhead is important, as outlined in this blog . My job was to port a security critical network processing…
107
Latest Firefox Brings Privacy Protections Front and Center
Our push this year has been building privacy-centric features in our products that are on by default. With this move, we’re taking the guesswork out of h
108
109
110
Weaponizing and Gamifying AI for WiFi Hacking: Presenting Pwnagotchi 1.0.0
This is the story of a summer project that started out of boredom and that evolved into something incredibly fun and unique. It is also the story of how that p…
111
DNS Security: Threat Modeling DNSSEC, DoT, and DoH
There's been a lot of talk about DNS-over-HTTPS aka DoH lately, primarily due to Mozilla's and Google's respective plans to move forward with enabling it in their browsers. There's also a lot of misunderstanding and conflation of speculated plans for world domination with practical benefits of the technology; it…
112
OnionShare makes it easy to publish anonymous, uncensorable websites
I’m excited to announce that OnionShare 2.2 is released! You can download it from onionshare.org. When I first wrote OnionShare in 2014, it let you anonymously and securely send files to people. It worked like this: OnionShare zips up the files, starts a local web server on
113
114
Victory! Ruling in hiQ v. Linkedin Protects Scraping of Public Data
In a long-awaited decision in hiQ Labs, Inc. v. LinkedIn Corp., the Ninth Circuit Court of Appeals ruled that automated scraping of publicly accessible data likely does not violate the Computer Fraud and Abuse Act (CFAA). This is an important clarification of the CFAA’s scope, which should provide...
115
Stealing sensitive browser data with the W3C Ambient Light Sensor API (2017)
In this post we describe and demonstrate a neat trick to exfiltrate sensitive information from your browser using a surprising tool: your smartphone or laptop’s ambient light sensor. In short: 1. We provide background about the light sensor API and current discussions to expose it more broadly to websites.
116
Reversing Safeway's private APIs to automate coupon collection
Reverse-engineering Safeway's coupon APIs to automate adding digital offers to an account.
117
China's New Cybersecurity Program: No Place to Hide
Chinese distributors can help foreign companies reach customers without setting up a business in China. The wrong agreement can leave a supplier locked into years of poor sales, trademark disputes, or regulatory problems. Here are ten issues we address before a client signs.
118
119
Monzo: How our security team handle secrets
We recently designed a new system to manage secret information safely – from the keys that we use to sign your Mastercard transactions, to credentials for external services.
120
Pair Locking Your iPhone
Learn how to pair lock your iPhone to break law enforcement forensics tools and protect your data.