121
Digital signatures and how to avoid them
Wikipedia’s definition of a digital signature is: A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents. A valid digital signature on a messag…
New
The latest blog posts to take off on Hacker News. 536 posts.
122
123
Is Tor still safe to use?
This blog post is a response to an investigative news report about a large-scale law-enforcement attack that managed to de-anonymize a user of an old version of the long-retired app Ricochet. This blog post aims to provide insight into what we know so far. Nothing that the Tor Project has learned about this incident…
124
0day Contest for End-of-Life Devices Announced
The Junkyard contest focuses on deprecated systems, responsible disclosure, and meme-worthy exploits. Join us today!
125
Warning: DNS encryption in Little Snitch 6.1 may occasionally fail
UPDATE: Spoke too soon… The problem discussed here turned out to be specific to Little Snitch 6.1 and not a general issue in macOS. It has already been fixed in Little Snitch 6.1.1. See the end of the article for details. DNS Encryption 101 When…
126
Fixing an Elgato HD60 S HDMI capture device with the help of Ghidra
This post has a little bit of everything. Hardware diagnostics, some suspiciously similar datasheets from two separate Taiwan chip manufacturers, and firmware reverse engineering. Read on if that sounds like fun!
127
How Chainalysis made their way into popular Monero wallets
An investigation into how malicious nodes run by Chainalysis made their way into defaults of popular Monero wallets.
128
Lazarus Group laundered $200M from 25 crypto hacks to fiat
Bluenoroff or APT38, more commonly referred to as Lazarus Group is a threat group which has been tied to the North Korean government since as early as 2009 primarily being financially motivated utilizing malware custom built for each target.
129
Void captures over a million Android TV boxes
Doctor Web experts have uncovered yet another case of an Android-based TV box infection. The malware, dubbed <a href="https://vms.drweb.com/search/?q=Android.Vo1d&lng=en"><b>Android.Vo1d</b></a>, has infected nearly 1.3 million devices belonging to users in 197 countries. It is a backdoor that puts its components in…
130
Zero-Click Calendar invite vulnerability chain in macOS
Critical zero-click vulnerability chain in macOS (patched)
131
132
Better-performing “25519” elliptic-curve cryptography
Automated reasoning and optimizations specific to CPU microarchitectures improve both performance and assurance of correct implementation.
133
Vulnerabilities in the Feeld dating app
Discover critical Feeld app vulnerabilities from our pentest. See how flaws in security controls expose personal data and learn key fixes.
134
We spent $20 to achieve RCE and accidentally became the admins of .mobi
Welcome back to another watchTowr Labs blog. Brace yourselves, this is one of our most astounding discoveries. Summary What started out as a bit of fun between colleagues while avoiding the Vegas heat and $20 bottles of water in our Black Hat hotel rooms - has now seemingly become a major
135
OpenSSH Keystroke Obfuscation Bypass
A disclosure for an OpenSSH keystroke obfuscation bypass affecting current OpenSSH versions after 9.4.
136
Our Git Hash Bug
Things this developer thinks might be interesting to you.
137
Hacking misconfigured AWS S3 buckets: A complete guide
AWS S3 (Simple Storage Service) buckets are a popular storage service used by software companies and organizations to store public as well as sensitive data. However, the implementation of this servic...
138
Nobody Cares About Security
Nobody cares about security. There. I said it. I said the thing everyone feels, some people think, but very few have the temerity to say out loud. But before you call me...
139
140
"Unstripping" binaries: Restoring debugging information in GDB with Pwndbg
GDB loses significant functionality when debugging binaries that lack debugging symbols (also known as “stripped binaries”). Function and variable names become meaningless addresses; setting breakpoints requires tracking down relevant function addresses from an external source; and printing out structured values…
141
Baiting the bot
LLM chatbots can be engaged in endless "conversations" by considerably simpler text generation bots. This has some interesting implications.
142
The "email is authentication" pattern
By Ruben Schade in Eora/Sydney, Australia.
143
Cracking an old ZIP file to help open source the ANC's "Vula" secret crypto code
It's not often that you find yourself staring at code that few people have ever seen, code that was an important part in bringing down the a...
144
Keyhole – Forge own Windows Store licenses
By WitherOrNot
145
The Insecurity of Debian
The difference in security defaults between Debian and Red Hat.
146
EUCLEAK Side-Channel Attack on the YubiKey 5 Series
Download the Writeup Illustration Romain Flamand – Flamingo Studio – flamandromain@gmail.com Abstract Secure elements are small microcontrollers whose main purpose is to generate/store secrets and then execute cryptographic operations. They undergo the highest level of security evaluations that exists (Common…
147
IPMI
I am making steady progress towards moving the Computers Are Bad enterprise cloud to its new home, here in New Mexico. One of the steps in this process is, of course, purchasing a new server... the current Big Iron is getting rather old (probably about a decade!) and here in town I'll have the rack space for more…
148
Owners of 1-Time Passcode Theft Service Plead Guilty
Three men in the United Kingdom have pleaded guilty to operating otp[.]agency , a once popular online service that helped attackers intercept the one-time passcodes (OTPs) that many websites require as a second authentication factor in addition to passwords.
149
OAuth from First Principles
I've wanted to write a blog post for everyone who learns things the same way that I do; by trying to break them. I'll start off with an awfully flawed implementation that authorizes a user with a 3...
150
