91
Escaping the Chrome Sandbox Through DevTools
This blog post details how I found CVE-2024-6778 and CVE-2024-5836, which are vulnerabilities within the Chromium web browser which allowed for a sandbox escape from a browser extension.
New
The latest blog posts to take off on Hacker News. 536 posts.
92
Should We Chat, Too? Security Analysis of WeChat's Mmtls Encryption Protocol
This report performs the first public analysis of MMTLS, the main network protocol used by WeChat, an app with over one billion users. The report finds that MMTLS is a modified version of TLS, however some of the modifications have introduced cryptographic weaknesses.
93
We outsmarted CSGO cheaters with IdentityLogger
Learn how IdentityLogger used fingerprinting to combat ban evasion, protecting our CSGO community from relentless cheaters.
94
MacOS sometimes leaks traffic after system updates
We have found that you could be leaking traffic on macOS after system updates. To our current knowledge a reboot resolves it. We are currently investigating this and will follow up with more information.
95
FIDO Alliance publishes new spec to let users move passkeys across providers
The FIDO Alliance has published a working draft of a new set of specifications for secure credential exchange that, when standardized and implemented by
96
ACF has been hijacked
It’s super late at night on Thanksgiving weekend in Canada. I shouldn’t be thinking about weird internet drama, but here we are.
97
"Begin disabling installed extensions still using Manifest V2 in Chrome stable"
Details of the Manifest V2 phase-out and end of life.
98
A free and open internet shouldn't come at the expense of privacy
MARK SURMAN, PRESIDENT, MOZILLA Keeping the internet, and the content that makes it a vital and vibrant part of our global society, free and accessible has
99
European govt air-gapped systems breached using custom malware
ESET Research analyzed two separate toolsets for breaching air-gapped systems, used by a cyberespionage threat actor known as GoldenJackal.
100
Can you get root with only a cigarette lighter?
Before you can write an exploit, you need a bug. When there are no bugs, we have to get creative—that's where Fault Injection comes in. Fault injection can take many forms, including software-controlled data corruption, power glitching, clock glitching, electromagnetic pulses, lasers, and more.
101
How to stop advertisers from tracking your teen across the internet
When children turn 13, they age out of the data protections provided by the Children’s Online Privacy Protection Act (COPPA). Then, they become targets for data collection from data brokers that collect their information from social media apps, shopping history, location tracking services, and more.
102
Mitmproxy 11: Full HTTP/3 Support
We are excited to announce the release of mitmproxy 11, which introduces full support for HTTP/3 in both transparent and reverse proxy modes. We’re also bringing in a ton of DNS improvements that we’ll cover in this blog post.
103
Perfctl: Stealthy malware targeting Linux servers
Perfctl is particularly elusive and persistent malware employing several sophisticated techniques
104
EU: Definition of "potential terrorists" opens door to broad information-sharing
EU member states can now collect and share information on “potential terrorists”. This category is based on a new informal definition that was agreed with no democratic scrutiny. While claiming to target those who may engage in political violence, there is potential for far broader application.
105
FTC Report Confirms: Commercial Surveillance Is Out of Control
A new Federal Trade Commission (FTC) report confirms what EFF has been warning about for years: tech giants are widely harvesting and sharing your personal information to fuel their online behavioral advertising businesses.
106
Attacking UNIX Systems via CUPS
Hello friends, this is the first of two, possibly three (if and when I have time to finish the Windows research) writeups. We will start with targeting GNU/Lin…
107
Hacking Kia: Remotely controlling cars with just a license plate
On June 11th, 2024, we discovered a set of vulnerabilities in Kia vehicles that allowed remote control over key functions using only a license plate. These attacks could be executed remotely on any hardware-equipped vehicle in about 30 seconds, regardless of whether it had an active Kia Connect subscription.
108
AWS Nitro Enclaves: Attack Surface
In the race to secure cloud applications, AWS Nitro Enclaves have emerged as a powerful tool for isolating sensitive workloads. But with great power comes great responsibility-and potential security pitfalls. As pioneers in confidential computing security, we at Trail of Bits have scrutinized the attack surface of AWS…
109
Eliminating Memory Safety Vulnerabilities at the Source
Posted by Jeff Vander Stoep - Android team, and Alex Rebert - Security Foundations Memory safety vulnerabilities remain a pervasive threa...
110
Timeshare owner? The Mexican drug cartels want you
The FBI is warning timeshare owners to be wary of a prevalent telemarketing scam involving a violent Mexican drug cartel that tries to trick people into believing someone wants to buy their property. This is the story of a couple who recently lost more than $50,000 to an ongoing timeshare scam that spans at least two…
111
112
Firefox tracks you with “privacy preserving” feature
noyb filed a complaint against Mozilla for quietly enabling a supposed “privacy feature” (called Privacy Preserving Attribution) in its Firefox browser which tracks user behaviour on websites.
113
Preventing app removal on iOS
These days, I am developing an alarm app called ‘SuperAlarm’. To ensure a user is awake, SuperAlarm can be turned off only after a user completes a mission(e.g., taking a picture...
114
They stole my voice with AI
UPDATE 9/23: The CEO of Elecrow responded. I've posted a follow-up blog post with my reaction to the response and some other thoughts on AI voice cloning. Listen to this clip: Your browser does not support the video tag. I don't know about you, but that sounds pretty familiar. I mean I would like you to subscribe to…
115
Using YouTube to steal your files
A writeup of my $4133.70 Google Drive vulnerability chain.
116
Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
a post going over 4 exploits for CVE-2024-20017, a remotely exploitable buffer overflow in a component of the MediaTek MT7622 SDK.
117
Gaining access to anyones Arc browser without them even visiting a website
gaining access to anyones browser without them even visiting a website
118
Visual guide to SSH tunneling and port forwarding (2023)
Sysadmin doing syadmin stuff
119
GitHub notification emails used to send malware
Malicious actors are abusing legitimate notification emails sent by GitHub to try and trick people into downloading malware.
120
Turning Everyday Gadgets into Bombs Is a Bad Idea
I think turning everyday gadgets into bombs is a bad idea. However, recent news coverage has been framing the weaponization of pagers and radios in the Middle East as something we do not need to concern ourselves with because “we” are safe.