The latest blog posts to take off on Hacker News. 536 posts.
The direct result of bulletproof infrastructure / cloud providers which are "too big to fail" is the balkanized internet . I don't think this has fully come to pass, but it might be starting to happen or might come to pass soon.
A post outlining tricks for firewall privilege escalation
We discovered a serious vulnerability in the Known Crewmember (KCM) and Cockpit Access Security System (CASS) programs used by the Transportation Security Administration.
Related Website Sets is a user-hostile weakening of the Web's privacy model, plainly designed to benefit websites and advertisers, to the detriment of user privacy.
Today we learn that Pavel Durov, founder of the popular messaging app Telegram, has been arrested as his private jet landed in France. Early indications are that the arrest stems from Telegram̵…
Guest Post: Study finds more than 40 STARTTLS-related security flaws in many different software products, both client-side and server-side.
Malicious hackers are exploiting a zero-day vulnerability in Versa Director , a software product used by many Internet and IT service providers. Researchers believe the activity is linked to Volt Typhoon , a Chinese cyber espionage group focused on infiltrating critical U.S. networks and laying the groundwork for the…
Met deze test controleren we of u een mens bent. Hiermee voorkomen we ongeoorloofd gebruik van deze dienst.
This blog is reserved for more serious things, and ordinarily I wouldn’t spend time on questions like the above. But much as I’d like to spend my time writing about exciting topics, som…
Lineage OS is based on the Android Open-Source Project, whose primary maintainer is Google. To what extent can it be considered Google-free?
Did you know that birds aren't real? They are actually mobile devices that have cameras and microphones to maintain surveillance by the government. You may be asking yourself why they do not just use the cell phones in everyone's pocket; hey, I don't know; I don't make the rules.Now that I have completely destroyed my…
When writing code, you can call any function as long as it’s public, and similarly, you can access any object’s public properties or methods. Usually, access to code is all or none – a piece of code can be either public or private. Lately, I’ve been thinking about ways to implement more fine-grained access controls…
When it comes to designing secure protocols, I have a principle that goes like this: if you have to perform any cryptographic operation before verifying the MAC on a message you’ve received, it will somehow inevitably lead to doom.
Imagine this: an OpenSSH backdoor is discovered, maintainers rush to push out a fixed release package, security researchers trade technical details on mailing lists to analyze the backdoor code. Speculation abounds on the attribution and motives of the attacker, and the tech media pounces on the story. A near miss
Let’s start by defining the word Wardriving: it is the search for WIFI wireless networks from a vehicle equipped with a computer. This would be the classic definition. I define modern wardriving as the search for WIFI networks, Bluetooth devices … Continue reading →
Among the cryptographic missteps we see at Trail of Bits, “let’s build our own tool out of a hash function” is one of the most common. Clients have a problem along the lines of “we need to hash a bunch of different values together” or “we need a MAC” or “we need […]
Authors: PromptArmor
Inspiration of how we can use PDF as an attack vector and perform multiple attacks with huge subsequences to the victim.
Data harvesters are reaching into virtually every part of your digital life through the little-known surveillance hardware industry.
I decided to write this post because there's no concise way to explain the nuances of what's being described as one of the largest data breaches ever. Usually, it's easy to articulate a data breach; a service people provide their information to had someone snag it through
Part one: https://dayzerosec.com/blog/2023/04/17/reversing-the-amd-secure-processor-psp.html This is a follow-up part 2 to my previous post on the AMD Secure Processor (formerly known as the Platform Security Processor or "PSP"). In that post, I mentioned that the Cryptographic Co-Processor (CCP) is an essential…
In this post, I'll exploit CVE-2024-5830, a type confusion in Chrome that allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site.
Between March 2023 and May 2023, we identified multiple security vulnerabilities within points.com, the backend provider for a significant portion of airline and hotel rewards programs. These vulnerabilities would have enabled an attacker to access sensitive customer account information, including names, billing…
In a major decision on Friday, the federal Fifth Circuit Court of Appeals held that geofence warrants are “categorically prohibited by the Fourth Amendment.” Closely following arguments EFF has made in a number of cases, the court found that geofence warrants constitute the sort of “general,...
PDF slides from a presentation by Paul Gerste at DEF CON 32. It turns out some databases have vulnerabilities in their binary protocols that can be exploited by carefully crafted …
