1
The Modern Guide to OAuth
Learn how OAuth 2.0 works with this simplified explanation and guide. Learn what it is, why it's essential for secure authorization, and best practices for implementation.
New
The latest blog posts to take off on Hacker News. 678 posts.
2
Germany: Data retention to be abolished
According to the German Minister of Justice data retention or "the storage of telecommunications data without any reason" could soon come to an end.
3
Unusual login activity was due to bug
As part of our commitment to security, we regularly monitor our services for actual, suspected, or attempted malicious or unusual activity. We recently investigated reports of an uptick of users recei[..]
4
How did LastPass master passwords get compromised?
LastPass accounts are under attack. I look into how user’s master passwords might have leaked.
5
Anonymized data is rarely anonymous
Justin Sherman for Wired points out the farce that is anonymized data: Data on hundreds of millions of Americans’ races, genders, ethnicities, religions, sexual orientations, political beliefs, int…
6
Implant.ARM.iLOBleed.a
HP servers provide a management module called iLO (a.k.a. Integrated Lights-Out), which turns on as soon as the power cable is connected, loading a full-blown proprietary operating system. This module has full access to all the firmware, hardware, software, and operating system installed on the server. In addition to…
7
How Secure Boot Works on M1 Series Macs
This article has now been extensively corrected and modified.
8
9
10
11
Knock Knock Who's There? – An NSA VM
Back in 2017 (feels like ages ago) I decided to take a peek into the ShadowBrokers leaks and reverse some of the tools. I started on dewdrop simply because it had a macOS version. I made local presentations at 0xOpoSec and BSidesLisbon but those slides were never published for obvious reasons (aka live implants all…
12
Analysis and reverse-engineering of the original Starlink router
Honestly, I love the design of this thing. It reminds me of something from the good old sci-fi.
13
14
Cache Poisoning at Scale
Identifying and exploiting over 70 cache poisoning vulnerabilities across major bug bounty programs, including GitHub, GitLab, Shopify and HackerOne.
15
16
Microsoft Teams: 1 feature, 4 vulnerabilities
Microsoft Team's link preview feature is susceptible to spoofing and vulnerable to Server-Side Request Forgery. Team's Android users can be DoS'ed and, in the past, their IP address could be leaked.
17
Isolating Xwayland in a VM
In my last post, Qubes-lite with KVM and Wayland, I described setting up a Qubes-inspired Linux system that runs applications in virtual machines. A …
18
Hidden Networks in TP-Link Routers
I was debugging my WiFi settings this week when I noticed something strange. WiFi Analyzer was showing two hidden networks coming from my router, one for each frequency: 2.4GHz and 5GHz. Networks which I haven't configured and didn't appear in my router's admin interface. WTF?
19
20
Faking a Positive Covid Test
True cyber security combines advanced technology and best practice. Get tips and read articles on how to take your online security even further.
21
The Belgian government has removed ‘backdoor requirement’ from new law
The Belgian government has removed 'backdoor requirement' from new law after international protest.
22
China issues new encryption import control
On November 2, 2021, Ministry of Commerce of China (“MOFCOM”) officially released the revised Catalogue of Technologies Subject to Import Prohibition and Restriction (“Technology Catalogue”), effective immediately, which identifies, among others, foreign “data encryption technology employing a key length greater than…
23
RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
The Visual Studio Code server in Windows Subsystem for Linux uses a local WebSocket WebSocket connection to communicate with the Remote WSL extension. JavaScript in websites can connect to this server and execute arbitrary commands on the target system. Assigned CVE-2021-43907 and zero bounty. I paid 5 USD for the EC2…
24
Inverting PhotoDNA
Ribosome inverts Microsoft PhotoDNA hashes using machine learning.
25
New EU data blockage as German court would ban many cookie management providers
Alston & Bird’s Dan Felz and Peter Swire look at the recent Wiesbaden Administrative Cou
26
An iframe from googlesyndication.com tries to access the camera and microphone
The last thing we want is for an advertising network to access the Camera or Microphone on our computer. But, while looking for something else, I stumbled upon messages in the Safari JavaScript console saying that an iframe loaded from safeframe.googlesyndication.com tried to do exactly that.
27
28
A deep dive on a Facebook reseller of bikes stolen in Colorado
Bike Index tracks a Colorado-to-Mexico stolen bike pipeline - and learns things along the way
29
Third High Severity CVE in Log4j Is Published
The Logging Services Security Team takes security seriously. This allows our users to place their trust in Log4j for protecting their mission-critical data. On this page, we will help you find guidance on security-related issues and access to known vulnerabilities.
30
CCPA Scam – Human subject research study conducted by Princeton University
Get ready for the CCPA compliance scams from Princeton.