211
Everything old is new again: binary security of WebAssembly
Daniel Lehmann, University of Stuttgart; Johannes Kinder, Bundeswehr University Munich; Michael Pradel, University of Stuttgart
New
The latest blog posts to take off on Hacker News. 612 posts.
212
How to contact Google SRE by dropping a shell in Cloud SQL
Note: The vulnerabilities that are discussed in this post were patched quickly and properly by Google. We support responsible disclosure. The research that resulted in this post was done by me and …
213
Rust and C++ Interoperability in Chrome
Chrome engineers are experimenting with Rust. For the foreseeable future, C++ is the reigning monarch in our codebase, and any use of Rust will need to fit in with C++ — not the other way around. This seems to present some C++/ Rust interoperability challenges which nobody else has faced.
214
Accused spy Alexander Yuk Ching Ma evidently beat the polygraph
On Thursday, 13 August 2020, FBI Special Agent Chris Jensen filed under seal a criminal complaint against Alexander Yuk Ching Ma of Honolulu, Hawaii, charging him with “Conspiracy to Gather and Communicate National Defense Information of the United States to a Foreign Nation.” On Monday, 17 August 2020, the complaint…
215
Using a Yubikey as a touchless, magic unlock key for Linux
Yubikeys are great for security, but their benefits decrease somewhat when you leave them in your computer unattended. I also have login passwords that are way too long. How to solve these problems? Use a Yubikey to unlock your computer!
216
Microsoft Put Off Fixing Zero Day for 2 Years
A security flaw in the way Microsoft Windows guards users against malicious files was actively exploited in malware attacks for two years before last week, when Microsoft finally issued a software update to correct the problem.
217
How Purism avoids Intel’s Active Management Technology
With recent chipsets, Intel offers a mechanism called Active Management Technology (Intel AMT, part of the “vPro”* featureset, specifically the Intel Management Engine) which, Intel says,“allows IT or managed service providers to better discover, repair, and protect their networked computing assets”. This means…
218
Hiding messages in x86 binaries using semantic duals
This is a quick writeup of a steganographic tool that I threw together: steg86 . It uses a quirk of the x86 instruction encoding format to hide messages in pre-existing binaries with no size or performance overhead.
219
220
Firefox and Chromium
Firefox is sometimes recommended as a supposedly more secure browser because of its parent company's privacy practices. This article explains why this notion is not true and enumerates a number of security weaknesses in Firefox's security model when compared to Chromium. In particular, it covers the less granular…
221
Stopping phishing campaigns with Bash
Personal Blog of Christian Haschek
222
223
TSA considers new system for flyers without ID
According to a solicitation to potential contractors published last week, the Transportation Security Administration (TSA) wants to outsource its current questioning of airline passengers without ID , and its decisions about which travelers without ID to allow to travel and which to prevent from flying , to a…
224
Office Drama on macOS
infecting macOS via macro-laden documents and 0days
225
Over 400 vulnerabilities on Qualcomm’s Snapdragon chip
Over 400 vulnerabilities on Qualcomm’s Snapdragon chip threaten mobile phones’ usability worldwide With over 3 billion users globally, smartphones are an %
226
The Linux Backdoor Attempt of 2003 (2013)
Josh wrote recently about a serious security bug that appeared in Debian Linux back in 2006, and whether it was really a backdoor inserted by the NSA. (He concluded that it probably was not.) Today I want to write about another incident, in 2003, in which someone tried to backdoor the Linux kernel. This one […]
227
228
Dorking: the use of search engines to find very specific data
tl;dr: Use advanced Google Search to find any webpage, emails, info, or secrets cost: $0 time: 2 minutes Software engineers have long joked about how much of their job is simply Googling things Now you can do the same, but for free Below, I'll cover dorking, the use of …
229
Exploiting Android Messengers with WebRTC
Posted by Natalie Silvanovich, Project ZeroThis is a three-part series on exploiting messenger ap...
230
Pysa: An open source tool to detect and prevent security issues in Python code
Today, we are sharing details about Pysa, an open source static analysis tool we’ve built to detect and prevent security and privacy issues in Python code. Last year, we shared how we built Zoncola…
231
I'm Open Sourcing the Have I Been Pwned Code Base
Let me just cut straight to it: I'm going to open source the Have I Been Pwned code base. The decision has been a while coming and it took a failed M&A process to get here, but the code will be turned over to the public for the
232
Auth is now available in Supabase (YC S20)
Authenticate and authorize your users with Supabase Auth
233
Latest Firefox rolls out Enhanced Tracking Protection 2.0
Today, Firefox is introducing Enhanced Tracking Protection (ETP) 2.0, our next step in continuing to provide a safe and private experience for our users. E
234
Changes to SameSite Cookie Behavior – A Call to Action for Web Developers
Browsers are changing the default value of the SameSite attribute for cookies from None to Lax. This will greatly improve security for users. However, some web sites may depend (even ...
235
Gitlab Support is no longer processing MFA resets for free users
From August 15th, GitLab Support will no longer be manually removing MFA from free accounts.
236
TikTok: Logs, Logs, Logs
We are in 2020 and the US president is about to ban TikTok, a video-sharing social network mobile app, because “it poses a risk to US…
237
Blue Team Rust: What Is “Memory Safety”, Really?
A brief technical primer on Rust's key security feature, with embedded-specific context.
238
Sandboxing and workload isolation
Documentation and guides from the team at Fly.io.
239
One Byte to rule them all
Posted by Brandon Azad, Project ZeroOne Byte to rule them all, One Byte to type them,One Byte to ...
240
Is your chip card secure? Much depends on where you bank
Chip-based credit and debit cards are designed to make it infeasible for skimming devices or malware to clone your card when you pay for something by dipping the chip instead of swiping the stripe. But a recent series of malware attacks on U.S.-based merchants suggest thieves are exploiting weaknesses in how certain…