2551
Unintended consequences of blocking IP addresses
A discussion about IP blocking: why we see it, what it is, what it does, who it affects, and why it’s such a problematic way to address content online.
New
The latest blog posts to take off on Hacker News. 8,770 posts.
2552
Privacy is ok
I hate to write a piece just saying Someone Is Wrong On The Internet. But Reid Blackman’s The Signal App and the Danger of Privacy at All Costs (in the NYTimes , forsooth) is not just wrong but dangerously misleading. I haven’t seen a compact explainer on why, so here goes.
2553
2554
Wiretapping Google smart speakers
I was recently rewarded a total of $107,500 by Google for responsibly disclosing security issues in the Google Home smart speaker that allowed an attacker within wireless proximity to install a "backdoor" account on the device, enabling them to send commands to it remotely over the Internet, access its microphone…
2555
What’s in a PR statement: LastPass breach explained
The LastPass statement on their latest breach is full of omissions, half-truths and outright lies. I’m providing the necessary context for some of their claims.
2556
CCC captures U.S. military biometrics database
The U.S. military used biometric devices en masse to capture people in Afghanistan. Some devices were left behind during the hasty withdrawal of NATO troops. CCC researchers found large amounts of...
2557
Google removed my Yubikeys from a Google account 'just to be safe'
The world's worst security flow
2558
Reverse engineering yet another eBook format
In the distant past I was super into removing DRM from books and magazines (check out my posts on that topic: Removing Edge Magazine DRM , Removing Zinio DRM ). This interest eventually faded away, mostly because I just stopped using websites that wouldn’t allow me to download and own the products I paid for (kudos to…
2559
Cracking encrypted LastPass vaults
The recent (2022) compromise of Lastpass included email addresses, home addresses, names, and encrypted customer vaults. In this post I will demonstrate how attackers may leverage tools like Hashcat to crack an encrypted vault with a weak password.
2560
Reverse Engineering TikTok's VM Obfuscation
TikTok has a reputation for its aggressive data collection. The platform has implemented various methods to make it difficult for reverse-engineers to understand exactly what data is being collected and how it is being used.
2561
Python malware starting to employ anti-debug techniques
First time anti-debug techniques are discovered in PyPI malware. Read how these techniques are implemented, including analysis and tips from JFrog Security Research.
2562
Linux Kernel Ksmbd Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are vulnerable.
2563
Password Requirements: Myths and Madness
Password requirements are weird. It seems impossible to set a new password in many websites. Why?
2564
LastPass user vaults stolen in recent hack
Please refer to the latest article for updated information.nbs[..]
2565
Threeuk is blocking Tutanota
ISPs must not have the power to decide which online services users can or can not access.
2566
Tencent WeChat is now a GitHub secret scanning partner
GitHub secret scanning protects users by searching repositories for known types of secrets. By identifying and flagging these secrets, our scans help prevent data leaks and fraud. We have partnered…
2567
Towards a More Open Secure Element Chip
“ Secure Element ” (SE) chips have traditionally taken a very closed-source, NDA-heavy approach. Thus, it piqued my interest when an early-stage SE chip startup, Cramium (still in stealth mode), approached me to advise on open source strategy. This blog post explains my reasoning for agreeing to advise Cramium, and…
2568
Let's Encrypt now supports ACME-CAA: closing the DV loophole
Today, Let's Encrypt announced that they are enabling an extension to DNS CAA records known as ACME-CAA ( RFC 8657 ). This came as a surprise to me, but a very pleasant one, since I wrote the ACME-CAA specification back in 2016 with Let's Encrypt in mind, and it was finally published as RFC 8657 back in 2019. To my…
2569
Get root on macOS 13.0.1 the macOS Dirty Cow bug
Get root on macOS 13.0.1 with CVE-2022-46689 (macOS equivalent of the Dirty Cow bug), using the testcase extracted from Apple’s XNU source.
2570
Getting started with nmap
Sysadmin doing syadmin stuff
2571
Supabase Vault is now in Beta
A Postgres extension to store encrypted secrets and encrypt data.
2572
BundesMessenger, a secure messenger for Germany’s public administration
BundesMessenger is a modified version of Element which we’re working with BWI to develop and maintain.
2573
Secret scanning is now available for free on public repositories
Previously, only organizations with GitHub Advanced Security could enable secret scanning's user experience on their repositories. Now, any admin of a public repository on GitHub.com can detect leaked secrets in…
2574
Six charged in mass takedown of DDoS-for-hire sites
The U.S. Department of Justice (DOJ) today seized four-dozen domains that sold “booter” or “stresser” services — businesses that make it easy and cheap for even non-technical users to launch powerful Distributed Denial of Service (DDoS) attacks designed knock targets offline. The DOJ also charged six U.S. men with…
2575
Tailnet Lock
Use this article learn how to decide who to trust when it comes to your tailnet’s coordination server and how nodes are added to your tailnet.
2576
Shutting down our unencrypted public DNS service
On the 16th January 2023 we will shut down our legacy public DNS service, currently reachable from this IP: 193.138.218.74
2577
EFF about EU: EIDAS 2.0 Sets a Dangerous Precedent for Web Security
The Council of the European Union this week adopted new language for regulations governing internet systems that may put the security of your browser at greater risk.The new language affects the EU’s electronic identification, authentication and trust services (eIDAS) rules, which are supposed to...
2578
VPN by Google One security assessment
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
2579
Fuzzing ping(8) and finding a 24 year old bug
FreeBSD had a security fluctuation in their implementation of ping(8) the other day. As someone who has done a lot of work on ping(8) in OpenBSD this tickled my interests.
2580
A Yubico FAQ about passkeys
Delve into Yubico's comprehensive guide about passkeys, a term encapsulating FIDO/WebAuthn credentials that offer a secure, passwordless experience.