2161
Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop
Have you ever been told that the company’s data on laptops is protected thanks to BitLocker? Well it turns out that this depends on BitLocker’s configuration…
New
The latest blog posts to take off on Hacker News. 8,770 posts.
2162
Microsoft’s Revocation of the Verisign Class 3 Public Primary G5 Root Cert
Microsoft has rolled back the revocation of the Verisign Class 3 Public Primary Certification Authority - G5 Root Certificate.
2163
2164
Pixel Binary Transparency: verifiable security for Pixel devices
Jay Hou, Software Engineer, TrustFabric (transparency.dev) Pixel Binary Transparency was originally announced in 2021; the following blog ...
2165
Iraq Blocks Telegram, Leaks Blackhole BGP Routes
This past weekend, the government of Iraq blocked the popular messaging app Telegram, citing the need to protect Iraqi’s personal data. However, when an Iraqi government network leaked out a BGP hijack used for the block, it became yet another BGP incident that was both intentional, but also accidental. Thankfully…
2166
The FBI proves again it can’t be trusted with Section 702
The FBI doesn’t believe that either our rights or the limitations that Congress has placed upon them matter when it comes to the vast amount of information about us collected under FISA Section 702. The latest exhibit in this is in yet another newly declassified opinion of the Foreign Intelligence Surveillance Court…
2167
Short session expiration does not help security
When logged into a web application, the session does not remain valid forever. Typically, the session expires after a fixed time after login, or after the user has been idle for some time. How long should these times be?
2168
Mullvad Browser
We have partnered with Mullvad VPN to develop the Mullvad Browser - a Tor Browser without Tor
2169
Petition to stop France from forcing browsers like Firefox to censor websites
The French government is considering a law that would require web browsers – like Mozilla's Firefox – to block websites chosen by the government.
2170
2171
Bypassing YouTube video download throttling
Have you ever tried to download videos from YouTube? I mean manually without relying on software like youtube-dl, yt-dlp or one of “these” websites. It’s much more complicated than you might think.
2172
2173
2174
The Yandex leak: How a Russian search giant uses consumer data
In late January 2023, almost 45 GB of source code from the Russian search giant Yandex was leaked on BreachForums by a former Yandex employee.
2175
“Please do not make it public” (Tencent’s Sogou Input Method)
In this report, we analyze the Windows, Android, and iOS versions of Tencent’s Sogou Input Method, the most popular Chinese-language input method in China. Our analysis found serious vulnerabilities in the app’s custom encryption system and how it encrypts sensitive data. These vulnerabilities could allow a network…
2176
Infrastructure audit completed by Radically Open Security
We tasked the Netherlands based security firm Radically Open Security (RoS) with performing the third audit towards our VPN infrastructure.
2177
Android 14 introduces cellular connectivity security features
Posted by Roger Piqueras Jover, Yomna Nasser, and Sudhi Herle Android is the first mobile operating system to introduce advanced cellular...
2178
PyPI Requires 2FA for New User Registrations
PyPI requires new users to enable 2FA before performing management actions.
2179
Kubernetes Exposed: One YAML Away from Disaster
We found two main misconfigurations in Kubernetes clusters belonging to more than 350 organizations openly accessible and largely unprotected.
2180
2181
Reverse Engineering the Apple Multipeer Connectivity Framework (2022)
Some time ago I was using Logic Pro to record some of my music and I needed a way to start and stop the recording from an iPhone, so I found about Logic Remote…
2182
Inception: A simple XOR can cause a Microarchitectural Stack Overflow
Over the past one and a half years, we have studied two phenomena that enable an unprivileged attacker to leak arbitrary information on all modern AMD CPUs:
2183
Blocked by Cloudflare
Well, it finally happened to me. I was blocked out of a website I use for work because of Cloudflare. And I have no idea if or when I'll be...
2184
Blueprint for a distributed multi-region IAM with Go and CockroachDB
Learn how to scale IAM globally. Ory provides secure multi-region identity solutions.
2185
2186
Teach a man to phish and he’s set for life
One frustrating aspect of email phishing is the frequency with which scammers fall back on tried-and-true methods that really have no business working these days. Like attaching a phishing email to a traditional, clean email message, or leveraging link redirects on LinkedIn , or abusing an encoding method that makes…
2187
Google AMP – The Newest of Evasive Phishing Tactic
Author: Dylan DuncanA new phishing tactic utilizing Google...
2188
Adtech is built on a privacy fault line
The IAPP's Cobun Zweifel-Keegan rounds up the latest privacy developments from Washington, D.C., and elsewhere in the U.S. for the week of 24 July 2023.
2189
The underground world of credit card network exploitation
SaaS companies face rising card testing attacks, with similar card parameters hinting at a possible bank leak. Stripe's Radar and custom rul
2190
Does Cloudflare’s 1.1.1.1 DNS Block Archive.is? (2019)
Short answer: no. Quite the opposite, actually — Archive.is is intentionally blocking 1.1.1.1 users. Here's why.