2371
No Source Code == No Patent
How we know you "have' the invention
New
The latest blog posts to take off on Hacker News. 8,770 posts.
2372
OpenSSH versus SSH
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
2373
2374
KeePassXC Audit Report
KeePassXC Password Manager
2375
Remote code execution vulnerability in Google they are not willing to fix
This is a story about a security vulnerability in Google that allowed me to run arbitrary code on the computers of 50+ Google employees. Although Google initially considered my finding a serious security incident, later on, it changed its mind and stated that my finding is not, in fact, a vulnerability, but the…
2376
New macOS malware steals info, including a user's entire Keychain database
ThreatDown detects new macOS malware like MacStealer that targets Keychain databases and steals sensitive user information. Talk to our security team.
2377
Prompt injection: what’s the worst that can happen?
Activity around building sophisticated applications on top of LLMs (Large Language Models) such as GPT-3/4/ChatGPT/etc is growing like wildfire right now. Many of these applications are potentially vulnerable to prompt …
2378
Supabase Auth: SSO, Mobile, and Server-Side Support
Supacharging Supabase Auth with Sign in with Apple on iOS, Single-Sign-On support with SAML 2.0, and PKCE for server-side rendering and mobile auth.
2379
Deploying key transparency at WhatsApp
WhatsApp has launched a new cryptographic security feature to automatically verify a secured connection based on key transparency. The feature requires no additional actions or steps from users an…
2380
Firefox rolls out Total Cookie Protection by default to more users
Updated Aug. 28, 2024. Take back your privacy Firefox is rolling out Total Cookie Protection by default to more Firefox users worldwide, making Firefox the
2381
FBI is warning people against using public phone-charging stations
The FBI is warning people against using public phone-charging stations, worrying that the combination power-data port can be used to inject malware onto the devices: Avoid using free charging stations in airports, hotels, or shopping centers. Bad actors have figured out ways to use public USB ports to introduce…
2382
A Cryptographic Near Miss
A recent issue in scalar multiplication makes for a good case study of how unsafe interfaces, undocumented assumptions, and time lead to vulnerabilities.
2383
2384
Reverse Engineering the Facebook Messenger API
Note: The focus of this article is to explain the process of reverse engineering, and it is not continually updated to reflect ongoing changes in Facebook APIs. If you are looking for updated details, consider basing your work on open-source projects like mautrix/meta , which is developed by my employer Beeper .
2385
What happens when you leak AWS credentials and how AWS minimizes the damage
I heard multiple times that AWS scans public GitHub repositories for AWS credentials and informs its users of the leaked credentials.
2386
The Bitcoin whitepaper is hidden in every copy of macOS
I just discovered that every copy of macOS ships with a hidden PDF of Satoshi Nakamoto's Bitcoin whitepaper. But why?
2387
Seized Genesis Market data is now searchable in Have I Been Pwned
A quick summary first before the details: This week, the FBI in cooperation with international law enforcement partners took down a notorious marketplace trading in stolen identity data in an effort they've named "Operation Cookie Monster". They've provided millions of impacted email addresses and passwords to Have I
2388
CAN Injection: Keyless car theft
This is a detective story about how a car was stolen - and how it uncovered an epidemic of high-tech car theft. It begins with a tweet. In April 2022, my friend Ian Tabor tweeted that vandals had been at his car, pulling apart the headlight and unplugging the cables.
2389
FBI seizes bot shop ‘Genesis Market’ amid arrests targeting operators, suppliers
Several domain names tied to Genesis Market , a bustling cybercrime store that sold access to passwords and other data stolen from millions of computers infected with malicious software, were seized by the Federal Bureau of Investigation (FBI) today. The domain seizures coincided with more than a hundred arrests in…
2390
Was there a U.S. nuclear weapons accident at a Dutch air base?
A photo in a Los Alamos National Laboratory (LANL) student briefing from 2022 shows four people inspecting what appears to be a damaged B61 nuclear bomb.
2391
German police raid DDoS-friendly host FlyHosting
Authorities in Germany this week seized Internet servers that powered FlyHosting , a dark web offering that catered to cybercriminals operating DDoS-for-hire services, KrebsOnSecurity has learned. FlyHosting first advertised on cybercrime forums in November 2022, saying it was a Germany-based hosting firm that was…
2392
The undocumented Android change that led to aCropalypse was reported during beta
The bug lies in closed-source Google-proprietary code so it’s a bit hard to inspect, but after some patch-diffing I concluded that the root cause was due to this horrible bit of API ‘design’: https://issuetracker.google.com/issues/180526528 .
2393
Germany opposes client-side scanning planned by EU
Germany opposes client-side scanning planned by EU - it would create an unprecedented surveillance monster that violates fundamental rights.
2394
2395
AAD misconfiguration led to Bing.com results manipulation, account takeover
How Wiz Research found a common misconfiguration in Azure Active Directory that compromised multiple Microsoft applications, including a Bing management portal
2396
Spyware vendors use 0-days and n-days against Android, iOS and Chrome
Google’s Threat Analysis Group (TAG) tracks actors involved in information operations (IO), government backed attacks and financially motivated abuse. For years, TAG has…
2397
Messaging layer security: Secure and usable end-to-end encryption
The IETF has approved publication of Messaging Layer Security (MLS), a new standard for end-to-end security that will make it easy for apps to provide the highest level of security to their users. End-to-end encryption is an increasingly important security feature in Internet applications. It keeps users’ information…
2398
2399
EU Commission doesn't understand what's written in its own chat control bill
Ylva Johansson is the EU Commissioner in charge of the Chat Control Bill. In recent days she has taken part in several interviews in Swedish media and also spoken in front of EU parliament members.
2400
UK sets up fake booter sites to muddy DDoS market
The United Kingdom’s National Crime Agency (NCA) has been busy setting up phony DDoS-for-hire websites that seek to collect information on users, remind them that launching DDoS attacks is illegal, and generally increase the level of paranoia for people looking to hire such services.