91
Dangerous bug in Chrome’s ‘New Tab’ page bypassed security features
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
New
The latest blog posts to take off on Hacker News. 678 posts.
92
TPM Sniffing
TL;DR : we reproduced Denis Andzakovic’s proof-of-concept showing that it is possible to read and write data from a BitLocker-protected device (for instance, a stolen laptop) by sniffing the TPM key from the LCP bus.
93
New and improved Linux Random Number Generator ready for testing
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
94
Security issue related to the NPM registry
We're sharing details of recent incidents on the npm registry, our investigations, and how we’re continuing to invest in the security of npm.
95
I hate password rules
The other day, I was creating a new account on the web. It was financial in nature, which means it gets one of my most secure passwords. I used Password Safe to generate this 16-character alphanumeric password: :s^Twd.J;3hzg=Q~ Which was rejected by the site, because it didn’t meet its password security rules. It took…
96
Chrome may start restricting requests to private networks
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
97
Portugal proposed law tries to sneak in biometric mass surveillance
Whilst the European Parliament has been fighting bravely for the rights of everyone in the EU to exist freely and with dignity in publicly accessible spaces, the government of Portugal is attempting to push their country in the opposite direction: one of digital authoritarianism. The Portuguese lead organisation in…
98
Blacksmith – Rowhammer bit flips on all DRAM devices today despite mitigations
We demonstrate that it is possible to trigger Rowhammer bit flips on all DRAM devices today despite deployed mitigations on commodity off-the-shelf systems with little effort. This result has a significant impact on the system’s security as DRAM devices in the wild cannot easily be fixed, and previous work showed…
99
Briar 1.4 – Offline sharing, message transfer via SD cards and USB sticks
Press release The Briar Project released version 1.4 of its Android app today. This release adds a couple of new features, highlighted below. First of all, users can now share the app offline. Prior to this release, the only way to get the app was to to download it from the internet, which requires an internet…
100
OAuth with Cloudflare workers on a statically generated site
An article on implementing OAuth user registration for a newsletter on a statically generated site using Cloudflare workers.
101
102
Hoax email blast abused poor coding in FBI website
The Federal Bureau of Investigation (FBI) confirmed today that its fbi.gov domain name and Internet address were used to blast out thousands of fake emails about a cybercrime investigation. According to an interview with the person who claimed responsibility for the hoax, the spam messages were sent by abusing…
103
Cloudflare blocks an almost 2 Tbps multi-vector DDoS attack
Earlier this week, Cloudflare automatically detected and mitigated a DDoS attack that peaked just below 2 Tbps — the largest we’ve seen to date.
104
Sign arbitrary data with your SSH keys
ssh-keygen can sign and verify signatures, and it's way better than PGP
105
106
macOS Zero-Day Used Against Hong-Kong Activists
Google researchers discovered a MacOS zero-day exploit being used against Hong Kong activists. It was a “watering hole” attack, which means the malware was hidden in a legitimate website. Users visiting that website would get infected. From an article: Google’s researchers were able to trigger the exploits and study…
107
I'm unsure of the security of simultaneous multithreading on modern x86 CPUs
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
108
109
Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS
Modern web applications typically rely on chains of multiple servers, which forward HTTP requests to one another. The attack surface created by this forwarding is increasingly receiving more attention, including the recent popularisation of cache poisoning...
110
111
Proposed illegal image detectors on devices are ‘easily fooled’
Proposed algorithms that detect illegal images on devices can be easily fooled with imperceptible changes to images, Imperial research has found.
112
The Invisible JavaScript Backdoor
A few months ago we saw a post on the r/programminghorror subreddit: A developer describes the struggle of identifying a syntax error resulting from an invisible Unicode character hidden in JavaScript source code. This post inspired an idea: What if a backdoor literally cannot be seen and thus evades detection even…
113
Tor Browser 11.0
Tor Browser 11.0 is now available from the Tor Browser download page and our distribution directory. This is the first stable release based on Firefox ESR 91, and includes an important update to Tor 0.4.6.8.
114
ProctorU is dystopian spyware
As part of my MSc, I have to take an online exam. Obviously, this means I am highly likely to cheat by looking up things on Wikipedia or by having a bit of paper with notes on it. EVIL! So, the exam body requires me to install ProctorU. It's a service which lets someone watch you through your laptop camera while you…
115
$ sudo rm -rf / === NPM install
🔎I authored this blog post whilst I was an employee of Gitpod for Gitpod. I no longer work at Gitpod. In what seems like a long time ago, in part because it is, I learned the catastrophic capabilities of this command the hard way, and I'm sure folks my
116
REvil Ransom Arrest, $6M Seizure, and $10M Reward
The U.S. Department of Justice today announced the arrest of Ukrainian man accused of deploying ransomware on behalf of the REvil ransomware gang, a Russian-speaking cybercriminal collective that has extorted hundreds of millions from victim organizations. The DOJ also said it had seized $6.1 million in cryptocurrency…
117
118
Simple SSH Security
Simple SSH Security Within a couple of minutes you can improve your SSH security significantly.
119
iPhone apps can tell many things about you through the accelerometer
Nearly every modern smartphone is equipped with an accelerometer, which, as the name implies, is a sensor that measures acceleration. It’s most commonly used for detecting the device’s orientation. It also has many other uses, whether as a game controller in racing games, as a pedometer for counting daily steps, or to…
120
Six Palestinian organizations hacked with NSO Group’s Pegasus Spyware
On 19 October 2021, Israeli Minister of Defense, Benny Gantz, announced the designation of six leading Palestinian civil society organizations in the Occupied Palestinian Territory as “terrorist organizations” under Israel’s Anti-Terrorism Law 2016. The groups named are Addameer; Al-Haq; Defense for Children …