151
You can't contain me: elevation-of-privilege vulnerability in Docker for Windows
I have been continuing my journey of searching for windows breakout vulnerabilities in popular applications and one that I discovered in March I found intere...
New
The latest blog posts to take off on Hacker News. 556 posts.
152
MikroTik routers are forwarding owners’ traffic to unknown attackers
[Update] 2018-09-05 11:00 GMT+8, with the generous help from the AS64073, 103.193.137.211 has been promptly suspended and is no longer a threat. Overview MikroTik is a Latvian company founded in 1996 to develop routers and wireless ISP systems. MikroTik now provides hardware and software for
153
Fear the reaper: characterization and fast detection of card skimmers
Fear the reaper: characterization and fast detection of card skimmers Scaife et al., USENIX Security 2018 Until I can get my hands on a Skim Reaper I’m not sure I’ll ever trust an ATM or other expo…
154
155
Changing Our Approach to Anti-Tracking
In the near future, Firefox will -- by default -- protect users by blocking tracking while also offering a clear set of controls to give our users more choice over what information they share with sites.
156
Approaching Access Control on the Web (Part I)
Learn how to build future-proof, state of the art login, access control and API security systems in this multipart series.
157
Very Good Security
“Never answer an anonymous letter” —Yogi Berra Did you ever wonder why doctor offices ask for your social security number? They don’t want to keep your SSN, but it’s the primary “key” that identifies you to an insurance company. In computer science/math terms, they need to call a function. Let’s call it: int…
158
Australia’s Proposed Surveillance Laws Will Break the Trust Tech Depends On
In the last few years, we’ve discovered just how much trust — whether we like it or not — we have all been obliged to place in modern technology. Third-party software, of unknown composition and security, runs on everything around us: from the phones we carry around, to the smart devices with...
159
Sen. Wyden Confirms Cell-Site Simulators Disrupt Emergency Calls
Sen. Ron Wyden has sent a letter to the U.S. Department of Justice concerning disruptions to 911 emergency services caused by law enforcement’s use of cell-site simulators (CSS, also known as IMSI catchers or Stingrays). In the letter, Sen. Wyden states that:Senior officials from the Harris...
160
Cracking Litter Box DRM
TLDR : My robot cat litter box bricks itself after a set number of washes with each soap cartridge so I reverse engineered and suppressed the verfication process to enable refilling.
161
Why Static Websites Need HTTPS
It was Jan last year that I suggested HTTPS adoption had passed the "tipping point" [https://www.troyhunt.com/https-adoption-has-reached-the-tipping-point/], that is, it had passed the moment of critical mass [https://en.wikipedia.org/wiki/The_Tipping_Point] and as I said at the
162
The NSA Continues to Violate Americans' Internet Privacy Rights
A federal court will be scrutinizing one of the National Security Agency’s worst spying programs on Monday. The case has the potential to restore crucial privacy protections for the millions of Americans who use the internet to communicate with family, friends, and others overseas.
163
164
Remote Code Execution on a Facebook server
I regularly search for vulnerabilities on big services that allow it and have a Bug Bounty program. Here is my first paper which covers a vulnerability I discovered on one of Facebook’s servers.
165
166
Court has confirmed coordinated raids of Zwiebelfreunde in Germany were illegal
Update July 10th: Last week Monday, prosecution stated that they will keep our things for further analysis, even after explicitly confirming to journalists that they are aware that our only connection to Riseup is the collection of donations. This includes items belonging to our partners, and other third parties like…
167
Intel Publishes Microcode Patches, No Benchmarking or Comparison Allowed
UPDATE: Intel has resolved their microcode licensing issue which I complained about in this blog post. The new license text is here .
168
How I recorded user behaviour on my competitor’s websites
A test that hijacked the Chrome back button to send visitors to a fake Google results page, then to mirrored competitor pages where heatmaps, sessions and typing were recorded. Google de-indexed the whole domain.
169
Telling the Truth About Defects in Technology Should Never Be Illegal
Congress has never made a law saying, "Corporations should get to decide who gets to publish truthful information about defects in their products,"— and the First Amendment wouldn't allow such a law — but that hasn't stopped corporations from conjuring one out of thin air, and then defending it as...
170
171
Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible?
Some people enter the technology industry to build newer, more exciting kinds of technology as quickly as possible. My keynote will savage these people and will burn important professional bridges, likely forcing me to join a monastery or another penance-focused organization. In my keynote, I will explain why the…
172
173
OpenPGPjs has passed an independent security audit
We maintain the OpenPGPjs encryption library. After some recent code enhancements, OpenPGPjs underwent an independent security audit, the results of which are discussed in this article.
174
Twitter's Secret “Guest Mode”
Twitter has an undocumented feature which lets you follow accounts without being logged in. Here's how I found it, and how you can use it. My crappy old TV has a crappy old web browser on it. One boring Sunday, I decided to see which websites worked and which didn't on a 6 year old browser. Anything using LetsEncrypt…
175
TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship
A new standard for cryptography is on the horizon, called Transport Level Security 1.3 (TLS 1.3). TLS 1.3 is a major update to cryptography, and
176
177
Dropbear SSH, a lightweight alternative to OpenSSH
Dropbear is a small and lightweight SSH server and client that can replace OpenSSH on any POSIX platform such as GNU / Linux, * BSD, Cygwin … Dropbear is free software since it is released under MIT-style licenses.
178
Understanding L1 Terminal Fault aka Foreshadow: What You Need to Know
L1 Terminal Fault/Foreshadow explained in ~three minutesFor a more detailed technical view of L1 Terminal Fault, please see this deeper dive with Jon Masters.How we got here: a brief history of modern microprocessor cachesModern computer microprocessors are complex machines, filled with many optimizations designed to…
179
LaTeX TikZ for Cryptographers
LaTeX Code for Cryptographic Images.
180