2671
Cracking Random Number Generators Using Machine Learning
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,441 posts.
2672
Popular Google Chrome extensions are constantly tracking you by default
Popular Google Chrome extensions are constantly tracking you per default, making it very difficult or impossible for you to opt-out.
2673
Verizon Routing Millions of IP Addresses for Cybercrime Gangs
Over the past few years, spammers have sought out large ranges of IP addresses. By spreading out their sending patterns across a wide range of IP addresses, they can attempt to defeat spam filters and get spam and malware emails delivered where they are not wanted. However, IPv4 addresses are getting scarce and hard…
2674
Privacy Is Not Dead: Beware the All-or-Nothing Mindset
Privacy is only dead if we let it die. Be careful about the all-or-nothing mindset in data privacy, it can do more damage than good to the cause. While striving for improvements, do not forget to cheer and celebrate each small win.
2675
Cooldown Support for Ruby Bundler
Most supply-chain attacks against RubyGems exploit a narrow window: an account is compromised, a malicious version ships, and any bundle install in the minutes that follow resolves straight to it. ...
2676
New differential fuzzing tool reveals novel HTTP request smuggling techniques
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
2677
2678
Members of Congress Demand Answers for the Unjust Domain Name Seizures
This morning, a bipartisan group of Representatives, led by Rep. Zoe Lofgren (D-Calif.), sent a pointed letter to Attorney General Eric Holder and the Secretary of Homeland Security Janet Napolitano protesting the recent spat of domain name seizures—executed on dubious copyright grounds—that have...
2679
The silent CVE in the heart of Kubernetes apiserver
An overview into CVE-2018-1002105's root cause and a program to test if your clusters are affected
2680
EFF: Help Us Protect Mesh Networking From Overbroad Patents
Earlier this year, we announced that along with the Cyberlaw Clinic at Harvard’s Berkman Center for Internet and Society, we were challenging six patent applications that, if granted, could threaten the development of 3D printing technology. We asked you—the community—for help, and your input was...
2681
Pacing model development in an era of cyber-critical capabilities
OpenAI is strengthening monitoring, alignment, and security for frontier AI models. See how new safeguards are guiding the pace of model development.
2682
2683
Lasershark: Fast, bidirectional communication into air-gapped systems
We present a novel approach to infiltrate data to air-gapped systems without any additional hardware on-site.
2684
2685
PyPI: Python packets steal AWS keys from users
Multiple Python packages caught by Sonatype were seen uploading secrets such as AWS keys and environment variables to a web endpoint.
2686
2687
The Missing Mt. Gox Bitcoins
The official blog of WizSec, a group of bitcoin security specialists, and their investigation into MtGox.
2688
Impact to DigitalOcean customers resulting from Mailchimp security incident
Today, we wanted to share an update about how DigitalOcean and our customers were impacted by a recent security incident disclosed by Mailchimp.
2689
2690
2691
Global Encryption Day: Demand End-to-End Encryption in DMs
Today is Global Encryption Day, a day to highlight why encryption is critical for a safe, private internet.
2692
2693
OpenSSL 1.1.1 End of Life
OpenSSL 1.1.1 series has reached its End of Life (EOL). As such it will no longer receive publicly available security fixes.
2694
WormGPT – The Generative AI Tool Cybercriminals Are Using
Protect sensitive data from phishing and social engineering with Varonis Interceptor, AI-native email security with 99.9% detection and real-time response.
2695
Bills Introduced by Congress Fail to Fix Unconstitutional NSA Spying
In the past two weeks Congress has introduced a slew of bills responding to the Guardian's publication of a top secret court order using Section 215 of the PATRIOT Act to demand that Verizon Business Network Services give the National Security Agency (NSA) a record of every customer's call history...
2696
Perfctl: Stealthy malware targeting Linux servers
Perfctl is particularly elusive and persistent malware employing several sophisticated techniques
2697
Attempts to Censor AntiPolygraph.org
AntiPolygraph.org has received a rather unpleasant letter from James D’Loughy, a lawyer representing NITV Federal Services, LLC (NITV), which markets a scientifically baseless voice-based lie detector called the “Computer Voice Stress Analyzer,” and its president, self-described “Renaissance Man” “Dr.” Charles Humble…
2698
Earn $200K by fuzzing for a weekend: Part 1
By applying well-known fuzzing techniques to a popular target, I found several bugs that in total yielded over $200K in bounties. In this article I will demonstrate how powerful fuzzing can be when applied to software which has not yet faced sufficient testing.
2699
Role-based access control like it was meant to be
Learn about role-based access control, its use cases and benefits.
2700
