181
Data accidentally exposed by Microsoft AI researchers
Wiz Research found a data exposure incident on Microsoft’s AI GitHub repository, including over 30,000 internal Microsoft Teams messages – all caused by one misconfigured SAS token
New
The latest blog posts to take off on Hacker News. 617 posts.
182
Unix shells are generally not viable access control mechanisms any more
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
183
184
Running one’s own root Certificate Authority in 2023
A tale how running your own x509 root CA – for internal services – changed in the last 20 years.
185
Yes, Android 14 still allows modification of system certificates
Tim Perry recently claimed in an article that “Android 14 blocks all modification of system certificates, even as root”. This sparked significant discussion on Hacker News. Thankfully my tests show that it is still possible to adjust the system certificate store in Android 14.
186
Norway Fining Meta $98,500 per Day for User Privacy Breach
Norway’s DPA Datatilsynet is penalizing Meta over alleged data privacy breaches, with profound implications across Europe. Learn more in the full news story!
187
An Opinionated Yubikey Set-Up Guide
How to set up a YubiKey 5 in 2023.
188
How I stay reasonably anonymous online (2022)
I'm not wanted by the FBI, nor am I worried about my ISP watching me, and I don't care about Google knowing what I search for. What I am worried about is cra...
189
How mobile apps illegally share personal data
Some mobile apps share your personal data immediately after they're opened. This isn't compliant with EU privacy laws
190
When MFA isn't MFA, or how we got phished
Due to a recent Google change, MFA isn't truly MFA.
191
Bug in macOS 14 Sonoma prevents our app from working
The macOS 14 Sonoma betas and release candidate contain a bug that causes the firewall to not filter traffic correctly. As a result, our app does not work.
192
Appeals court upholds right to post public laws online
SAN FRANCISCO—Technical standards like fire and electrical codes developed by private organizations but incorporated into public law can be freely disseminated without any liability for copyright infringement, a federal appeals court ruled Tuesday. Tuesday’s ruling by a three-judge panel of the U.S...
193
Any sufficiently advanced uninstaller is indistinguishable from malware
The common pattern of trying to delete yourself.
194
Free Download Manager backdoored – a possible supply chain attack on Linux
Kaspersky researchers analyzed a Linux backdoor disguised as Free Download Manager software that remained under the radar for at least three years.
195
Chrome: Heap buffer overflow in WebP
The Stable and Extended stable channels has been updated to 116.0.5845.187 for Mac and Linux and 116.0.5845.187/.188 for Windows, which will...
196
OpenSSL 1.1.1 End of Life
OpenSSL 1.1.1 series has reached its End of Life (EOL). As such it will no longer receive publicly available security fixes.
197
Privacy Nightmare on Wheels’: Every Car Brand Reviewed by Mozilla
Mozilla’s latest edition of *Privacy Not Included reveals how 25 major car brands collect and share deeply personal data, including sexual activity, facial expressions, and genetic and health information.
198
Snoop unto them as they snoop unto you
The official videos from DEFCON 31 have been posted! Below you can watch our talk “Snoop unto them as they snoop unto you”. The talk, slides, files
199
Scammers can exploit email forwarding flaws to impersonate high-profile domains
Sending an email with a forged address is easier than previously thought, due to flaws in the process that allows email forwarding, according to a research team led by computer scientists at the University of California San Diego.
200
TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.
Analysis of PDD’s app software by multiple experts is showing all the signs of red-flag concern. The calls to outside device data and functions that violate users’ privacy are far more aggressive than any well-known consumer shopping app.
201
NSO group iPhone zero-click, zero-day exploit captured in the wild
Citizen Lab found an actively exploited zero-click vulnerability being used to deliver NSO Group’s Pegasus mercenary spyware while checking the device of an individual employed by a Washington DC-based civil society organization with international offices. We refer to the exploit chain as BLASTPASS. The exploit chain…
202
Microsoft will assume liability for legal copyright risks of Copilot
With customers ask whether they can use Microsoft’s Copilot services without worrying about copyright claims, we are providing a straightforward answer: yes, you can, and if you are challenged on copyright grounds, we will assume responsibility for the potential legal risks involved.
203
North Korean campaign targeting security researchers
Threat Analysis Group shares findings on a new campaign by North Korean actors targeting security researchers.
204
Tailscale Has Partnered with Mullvad
Since Tailscale was founded in 2019, customers have been forced to choose between either Tailscale or Mullvad without the ability for them to co-exist.
205
Mullvad on Tailscale: Privately browse the web
Learn how Tailscale's partnership with Mullvad enables secure, private browsing with Mullvad’s VPN servers as exit nodes. Protect your internet traffic, maintain privacy, and enjoy fast, encrypted browsing worldwide. Discover how to configure Mullvad with Tailscale for ultimate security.
206
When URL parsers disagree
Discovery and walkthrough of CVE-2023-38633 in librsvg, when two URL parser implementations (Rust and Glib) disagree on file scheme parsing leading to path traversal.
207
Results of technical investigations for Storm-0558 key acquisition
Microsoft Security Response Center Blog
208
It’s Official: Cars Are the Worst Category We Have Ever Reviewed for Privacy
Privacy Not Included was launched in 2017 to help you understand the privacy risks of tech products that connect to the internet. We are continuing that work in the form of Product Reviews at our magazine Nothing Personal, where our privacy experts do hours of hands-on testing and research on the most popular consumer…
209
On the 10th anniversary of the Snowden revelations
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
210
Fighting API bots with Cloudflare's invisible turnstile
There's a "hidden" API on HIBP. Well, it's not "hidden" insofar as it's easily discoverable if you watch the network traffic from the client, but it's not meant to be called directly, rather only via the web app. It's called "unified search" and it looks