121
Critical Security Issue Identified in iTerm2
A security audit funded by Mozilla has discovered a critical security vulnerability in the widely used macOS terminal emulator iTerm2.
New
The latest blog posts to take off on Hacker News. 579 posts.
122
Ken Thompson's Unix Password
Somewhere around 2014 I found an /etc/passwd file in some dumps of the BSD 3 source tree, containing passwords of all the old timers such as Dennis Ritchie, Ken Thompson, Brian W. Kernighan, Steve Bourne and Bill Joy.
123
Designing a COM Library for Rust
I interned with Microsoft as a Software Engineering Intern in the MSRC UK team in Cheltenham this past summer. I worked in the Safe Systems Programming Language (SSPL) group, which explores safe programming languages as a proactive measure against memory-safety related vulnerabilities.
124
Elliptic Curve Cryptography Explained
Fang-Pen Lin's blog about programming
125
My application ran away and called home from Redmond
I recently found a surprising leak vector in Windows 10 installations. We were porting our Beacon to Windows and for easy deployment…
126
127
VPN⁰: A Privacy-Preserving Distributed VPN
This research presents VPN⁰, the first distributed virtual private network offering a privacy preserving traffic authorization and validation mechanism.
128
Open Letter from Governments to Facebook Is an All-Out Attack on Encryption
Top law enforcement officials in the United States, United Kingdom, and Australia told Facebook today that they want backdoor access to all encrypted messages sent on all its platforms. In an open letter, these governments called on Mark Zuckerberg to stop Facebook’s plan to introduce end-to-end...
129
EFF Wins Access to License Plate Reader Data to Study Law Enforcement Use
San Francisco—Electronic Frontier Foundation (EFF) and the American Civil Liberties Union Foundation of Southern California (ACLU SoCal) have reached an agreement with Los Angeles law enforcement agencies under which the police and sheriff’s departments will turn over license plate data they...
130
131
An Update on Plugin Security
Learn about Figma's response to the security vulnerabilities that were reported in a 3rd-party library that we use for plugin security
132
How a double-free bug in WhatsApp turns to remote code execution
In this blog post, I’m going to share about a double-free vulnerability that I discovered in WhatsApp for Android, and how I turned it into an RCE. I informed this to Facebook. Facebook acknowledged and patched it officially in WhatsApp version 2.19.244. Facebook reserved CVE-2019-11932 for this issue.
133
134
135
Keybase iOS Has a Backdoor?
Keybase’s iOS client has received a backdoor. It seems that Stellar, the extremely well-funded and well-marketed cryptocurrency, has struck a deal with Keybase…
136
Wireless attacks on aircraft instrument landing systems
Wireless attacks on aircraft instrument landing systems Sathaye et al., USENIX Security Symposium 2019 It’s been a while since we last looked at security attacks against connected real-world entiti…
137
Tethered Jailbreaks Are Back
Earlier today, a new iPhone Boot ROM exploit, checkm8 (or Apollo or Moonshine), was published on GitHub by axi0mX, affecting the iPhone 4S through the iPhone X. The vulnerability was patched in devices with A12 and A13 CPUs. As of this writing, the iPhone XS, XS Max, XR, 11, 11 Pro and 11 Pro Max […]
138
MyPayrollHR CEO Arrested, Admits to $70M Fraud
Earlier this month, employees at more than 1,000 companies saw one or two paycheck’s worth of funds deducted from their bank accounts after the CEO of their cloud payroll provider absconded with $35 million in payroll and tax deposits from customers . On Monday, the CEO was arrested and allegedly confessed that the…
139
140
Interview with the Guy Who Tried to Frame Me for Heroin Possession
In April 2013, I received via U.S. mail more than a gram of pure heroin as part of a scheme to get me arrested for drug possession. But the plan failed and the Ukrainian mastermind behind it soon after was imprisoned for unrelated cybercrime offenses. That individual recently gave his first interview since finishing…
141
Ways to leak your data: apps’ circumvention of the Android permissions system
50 ways to leak your data: an exploration of apps’ circumvention of the Android permissions system Reardon et al., USENIX Security Symposium 2019 The problem is all inside your app, she said to me …
142
Centralised DoH is bad for privacy
Recently, Mozilla announced it would be moving Firefox DNS lookups to Cloudflare by default, for its American audience.
143
WARP is here
Today, after a longer than expected wait, we're opening WARP and WARP+ to the general public. If you haven’t heard about it yet, WARP is a mobile app designed for everyone which uses our global network to secure all of your phone’s Internet traffic.
144
Drilling open a smart door lock in 4 seconds
The BBC asked us to have a look at some smart locks for a TV show recently. We didn’t have much prep time, but were genuinely shocked by just how easy this one was to compromise. Usually, we spend time looking at Bluetooth/RF, the mobile app, the API and then move on to hardware. This […]
145
Looking Back at the Snowden Revelations
Edward Snowden recently released his memoirs. In some parts of the Internet, this has rekindled an ancient debate: namely, was it all worth it? Did Snowden’s leaks make us better off, or did …
146
Reverse engineering a custom CPU from a single program
or: reverse-engineering a custom, unknown CPU from a single programtl;dr: We reverse-engineered a program written for a completely custom, unknown CPU architecture, without any documentation for th…
147
Google Chrome Keystone is modifying /var symlink on non SIP Macs causing k-panic
Reports that some AVID Users Macs would no longer boot. It now may be that a Google Chrome Keystone update modifies /var on NON SIP Protected Macs.
148
149
150
