1261
Google announces agreement to acquire Wiz
Google signed a definitive agreement to acquire Wiz. This deal will make it easier for companies to protect themselves across major clouds.
New
The latest blog posts to take off on Hacker News. 8,770 posts.
1262
Moving away from US cloud services
Relying on US cloud services poses legal and political risks for EU users, so I'm moving away from US cloud services. Here's how and why I did it.
1263
Zero-knowledge proofs, encoding Sudoku and Mario speedruns without semantic leak
We published our video on zero-knowledge proofs! Surprisingly, making this video took a lot of work. Zero-knowledge proofs for coloring are one of those algorithms that, in hindsight, seem beautifu…
1264
Extracting content from an LCP “protected” ePub
As Cory Doctorow once said "Any time that someone puts a lock on something that belongs to you but won't give you the key, that lock's not there for you." But here's the thing with the LCP DRM scheme; they do give you the key! As I've written about previously, LCP mostly relies on the user entering their password (the…
1265
Sign in as anyone: Bypassing SAML SSO authentication with parser differentials
Critical authentication bypass vulnerabilities were discovered in ruby-saml up to version 1.17.0. See how they were uncovered.
1266
Popular GitHub Action tj-actions/changed-files is compromised
Popular GitHub Action tj-actions/changed-files has been compromised with a payload that appears to attempt to dump secrets, impacting thousands of CI pipelines.
1267
Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
tj-actions/changed-files
1268
Decrypting encrypted files from Akira ransomware using a bunch of GPUs
I recently helped a company recover their data from the Akira ransomware without paying the ransom. I'm sharing how I did it, along with the full source code. Update: since this article was written, a new version of Akira ransomware has appeared that can't be decrypted with this method The c
1269
A 2FA app that tells you when you get `314159` (2024)
An indie project for early 2010s internet addicts
1270
Hidden Messages in Emojis and Hacking the US Treasury
On December 30th, while most of us were preparing for a New Year’s Eve celebration, the US Treasury was prepping a notice to lawmakers to notify them that their systems, which (obviously) contain highly sensitive, confidential data, had been compromised.
1271
TinyKVM: Fast sandbox that runs on top of Varnish
TinyKVM can be used to sandbox regular Linux programs or programs with specialized APIs embedded into your servers.
1272
Recursion kills: The story behind CVE-2024-8176 in libexpat
libexpat is a fast streaming XML parser. Alongside libxml2, Expat is one of the most widely used software libre XML parsers written in C, specifically C99. It is cross-platform and licensed under the MIT license .
1273
1274
Mark Klein, AT&T whistleblower who revealed NSA mass spying, has died
EFF is deeply saddened to learn of the passing of Mark Klein, a bona fide hero who risked civil liability and criminal prosecution to help expose a massive spying program that violated the rights of millions of Americans.Mark didn’t set out to change the world. For 22 years, he was a...
1275
Azure's Weakest Link? How API Connections Spill Secrets
Binary Security found the undocumented APIs for Azure API Connections. In this post we examine the inner workings of the Connections allowing us to escalate privileges and read secrets in backend resources for services ranging from Key Vaults, Storage Blobs, Defender ATP, to Enterprise Jira and SalesForce servers.
1276
The insecurity of telecom stacks in the wake of Salt Typhoon
Towards the end of last year, we learned that a group (allegedly affiliated with the Chinese government, referred to as “Salt Typhoon”) breached T-Mobile and other telecommunications co…
1277
My Scammer Girlfriend: Baiting a Romance Fraudster
Romance fraud has been growing as an issue for years. It's not uncommon to see news stories with bewildered victims explaining just how deeply they'd been sucked in. After receiving a number of opener
1278
Apple Exclaves
Enhancing kernel isolation, one step at a time.
1279
Take It Down Act: A Flawed Attempt to Protect Victims That'll Lead to Censorship
Congress has begun debating the TAKE IT DOWN Act (S. 146), a bill that seeks to speed up the removal of a troubling type of online content: non-consensual intimate imagery, or NCII. In recent years, concerns have also grown about the use of digital tools to alter or create such images, sometimes...
1280
Feds Link Cyberheist to 2022 LastPass Hacks
In September 2023, KrebsOnSecurity published findings from security researchers who concluded that a series of six-figure cyberheists across dozens of victims resulted from thieves cracking master passwords stolen from the password manager service LastPass in 2022. In a court filing this week, U.S. federal agents…
1281
Age Verification Laws: A Backdoor to Surveillance
I’m old enough to remember when age verification bills were pitched as a way to ‘save the kids from porn’ and shield them from other vague dangers lurking in the digital world (like…“the transgender”). We have long cautioned about the dangers of these laws, and pointed out why they are likely to...
1282
How to distrust a CA without any certificate errors
A “distrust” is when a certification authority (CA) that issues HTTPS certificates to websites is removed from a root store because it is no longer trusted to issue certificates. This means certificates issued by that CA will be treated as invalid, likely causing certificate error interstitials in any browser that…
1283
Exposing Russian EFF Impersonators: The Inside Story on Stealc and Pyramid C2
Discover how an open directory exposed a threat actor impersonating EFF to target gamers and how we mapped their infrastructure to Stealc & Pyramid C2.
1284
The "Take It Down" Act
We've opposed the Take It Down Act because it could be easily manipulated to take down lawful content that powerful people simply don't like. Last night, President Trump demonstrated he has a similar view on the bill. He wants to sign the bill into law, then use it to remove content about — him....
1285
Exploring the Paramilitary Leaks
In January, Distributed Denial of Secrets published over 200 gigabytes of chat logs and recordings from paramilitary groups and militias, including American Patriots Three Percent (APIIII) and the Oath Keepers. The files were obtained by John Williams, a wilderness survival trainer who spent years deep undercover…
1286
NCSC, GCHQ, UK Gov't expunge advice to “use Apple encryption”
This is some really embarrassing timing on the Home Office’s (HO’s) part: a few weeks ago when news first broke of the HO’s demand for a backdoor in Apple ADP, I pointed out to MP…
1287
1288
Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit
Finding and exploiting bugs in the Xbox 360 hypervisor to create the "Bad Update" exploit.
1289
Speedrunners are vulnerability researchers, they just don't know it yet
Video game enthusiasts are developing experience in the cybersecurity industry by accident. Discover how gaming skills can translate into intriguing careers.
1290
