1441
Reverse Engineering iOS 18 Inactivity Reboot
Wireless and firmware hacking, PhD life, Technology
New
The latest blog posts to take off on Hacker News. 8,770 posts.
1442
Are We PEP740 Yet?
PEP 740 is a Python standard for defining cryptographically verifiable attestations hosted by indices like PyPI.
1443
PyPI now supports digital attestations
Announcing support for PEP 740 on the Python Package Index
1444
A memory leak in Apple's Network Extension framework
Is it normal for the Little Snitch Network Extension to consume Gigabytes of memory? No it isn’t. Unfortunately that’s another new bug in the Network Extension framework of macOS. It’s a memory leak in Apple’s framework, which developers…
1445
1446
I Followed the Official AWS Amplify Guide and Was Charged $1,100
An interesting thing happens when you follow the official Amplify guide.
1447
The Beginner's Guide to Visual Prompt Injections (2023)
Learn about visual prompt injections, their appearance, and top defense strategies against these attacks.
1448
Abusing Ubuntu 24.04 features for root privilege escalation
With the recent release of Ubuntu 24.04, we at Snyk Security Labs thought it would be interesting to examine the latest version of this Linux distribution to see if we could find any interesting privilege escalation vulnerabilities.
1449
Bypassing regulatory locks, hacking AirPods and Faraday cages
How we bypassed Apple's regulatory restrictions, built a Faraday cage and enabled georestricted features on the Airpods Pro 2 for our grandparents.
1450
Security Is a Useless Controls Problem
We're all a bunch of chimps in a cage
1451
OpenID Connect specifications published as ISO standards
I’m thrilled to report that the OpenID Connect specifications have now been published as ISO/IEC standards. They are:
1452
Early Cascade Injection: From Windows process creation to stealthy injection
Get an introdcution to Early Cascade, a novel process injection technique that is effective against top tier EDRs while avoiding detection.
1453
SQLite does not do checksums
SQLite does not do checksums by default. Disk corruptions go silently unnoticed.
1454
How to find exploits in video games
Reverse Engineering: In this guide, I'll walk you through how I create tools to find exploits in video games for bug bounty programs. Specifically, I'll focus on my research into the game Sword of Convallaria. This exploration is purely for educational purposes. As such, I have removed some of the assets as an…
1455
Multiple new macOS sandbox escape vulnerabilities
This is a blog post for my presentation at the conference POC2024. The slides are uploaded here.
1456
Hyperlight: Virtual machine-based security for functions at scale
The Microsoft Azure Core Upstream team is excited to announce the Hyperlight project, an open-source Rust library you can use to create very small VMs for embedded functions. Learn more.
1457
Using Ghidra and Python to reverse engineer Ecco the Dolphin
Re-routing the encryption
1458
Combining Machine Learning and Homomorphic Encryption in the Apple Ecosystem
At Apple, we believe privacy is a fundamental human right. Our work to protect user privacy is informed by a set of privacy principles, and…
1459
Upcoming Hardening in PHP
Personal blog of Julien (jvoisin) Voisin
1460
Hacking 700M Electronic Arts accounts
(Ethically). Here's how I did it.
1461
Writing secure Go code
Security testing starts with understanding vulnerabilities. The CVE website lists known software flaws. The OWASP Top Ten highlights common weaknesses. With this knowledge, we can improve our Go development. This article shows how to put in place robust practices. They are fuzz inputs, verify dependencies, and use…
1462
Hacking cars in JavaScript (Replay attacks in the browser with the HackRF)
Collection of side projects, conference talks and blog posts experimenting with frontend technologies and human-computer interaction
1463
Using Large Language Models to Catch Vulnerabilities
Posted by the Big Sleep team Introduction In our previous post, Project Naptime: Evaluating Offe...
1464
Apple silently uploads your passwords and keeps them
This is a follow-up to my blog post macOS Sonoma silently enabled iCloud Keychain despite my precautions from five months ago. The TL;DR of that blog post is that when you have iCloud enabled but not iCloud Keychain, updating from Ventura to Sonoma causes iCloud Keychain to be silently enabled. (I don't know yet…
1465
Fuzzing between the lines in popular barcode software
Fuzzing—one of the most successful techniques for finding security bugs, consistently featured in articles and industry conferences—has become so popular that you may think most important software has already been extensively fuzzed. But that’s not always the case. In this blog post, we show how we fuzzed the ZBar…
1466
RCE Vulnerability in QBittorrent
[…] Security has unveiled a critical vulnerability that has lingered in the popular torrent client qBittorrent for over 14 […]
1467
Looking into the Nintendo Alarmo
While everyone was waiting on news for the successor of the Nintendo Switch, Nintendo released the Alarmo. A small plastic alarm clock that ...
1468
CFPB finalizes personal financial data rights rule
The Consumer Finance Protection Bureau (CFPB) has just finalized a rule that makes it easy and safe for you to figure out which bank will give you the best deal and switch to that bank, with just a couple of clicks. We love this kind of thing: the coolest thing about a digital world is how easy it...
1469
The Karma connection in Chrome Web Store
A bunch of malicious extensions in Chrome Web Store have hidden affiliate fraud functionality, collect users’ browsing profiles, or both. These extensions appear to be connected to the Karma shopping assistant, developed by Karma Shopping Ltd. which is not a small company.
1470
How to get the whole planet to send abuse complaints to your best friends
It all begins with one scary email late at night just before I had to go to sleep: