2851
Supporting Let’s Encrypt, the nonprofit making HTTPS free for all
Today, we’re thrilled to be partnering with Let’s Encrypt, the world’s largest certificate authority.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,441 posts.
2852
2853
Drone hijacked by UT hackers with $1,000 spoofer
The Sophos Blog
2854
2855
Sunsetting Tor Messenger
In 2015, we introduced Tor Messenger, a cross-platform chat program that aimed to be secure by...
2856
Top Mental Health and Prayer Apps Fail at Privacy, Security (2022)
Despite dealing with issues like depression, suicide, domestic violence, and PTSD, these apps share data freely and raise many security concerns
2857
Curl audit: How a joke led to significant findings
In fall 2022, Trail of Bits audited cURL, a widely-used command-line utility that transfers data between a server and supports various protocols. The project coincided with a Trail of Bits maker week, which meant that we had more manpower than we usually do, allowing us to take a nonstandard approach to the […]
2858
The weaponization of travel blacklists
[A Federal Air Marshal (FAM) tasked with surveillance of an airline passenger targeted by Quiet Skies lists and/or rules followed the traveler out to the curb and recorded the license plate number of the vehicle in which she left the airport, so that her airline reservations could be integrated with license plate…
2859
The Linux Backdoor Attempt of 2003
Josh wrote recently about a serious security bug that appeared in Debian Linux back in 2006, and whether it was really a backdoor inserted by the NSA. (He concluded that it probably was not.) Today I want to write about another incident, in 2003, in which someone tried to backdoor the Linux kernel. This one […]
2860
Bank of America Giving Access to Random Accounts
Today, we received an invoice for one of our expenses. To send the payment, I logged into Bank of America's website to use their ACH (Automated Clearing
2861
2862
Bypassing macOS TCC user privacy protections by accident and design
TCC is meant to protect user data from unauthorized access, but design flaws mean users and malware can bypass TCC, even by accident.
2863
Hacking root EPP servers to take control of zones
Finding vulnerabilities in global domain infrastructure to take control of ccTLD zones. Vulnerabilities in EPP
2864
Cascade: CPU fuzzing via intricate program generation
Cascade is a RISC-V CPU fuzzer that generates valid , long and complex programs, and relies on a termination cascade-effect for bug detection. It detected 37 new bugs (29 new CVEs) in 5 RISC-V CPUs, which is more than all the existing fuzzers, combined. You can read a paper we wrote on Cascade here and try it out here…
2865
2866
Requiring secure contexts for all new features
Since Let’s Encrypt launched, secure contexts have become much more mature. We have witnessed the successful restriction of existing, as well as new features to secure contexts. The W3C TAG ...
2867
Funds of every Trust Wallet browser extension could have been stolen
Seed generation of Trust Wallet was flawed, the total entropy was only 32 bits. We have created a file containing all possible seeds. Fortunately, the Ledger Donjon discovered the vulnerability very quickly and likely avoided one of the biggest hack in the crypto ecosystem.
2868
2869
Apache Struts Statement on Equifax Security Breach
UPDATE: MEDIA ALERT: The Apache Software Foundation Confirms Equifax Data Breach Due to Failure to Install Patches Provided for Apache® Struts™ Exploit The Apache Struts Project Management Committee (PMC) would like to comment on the Equifax security breach, its relation to the Apache Struts Web Framework and…
2870
2871
Apple's Crystal Prison and the Future of Open Platforms
Two weeks ago, Steve Wozniak made a public call for Apple to open its platforms for those who wish to tinker, tweak and innovate with their internals. EFF supports Wozniak's position: while Apple's products have many virtues, they are marred by an ugly set of restrictions on what users and...
2872
Passkeys – Under the Hood
The Latest News from Research at Kudelski Security
2873
2874
Simple SSH Security
Simple SSH Security Within a couple of minutes you can improve your SSH security significantly.
2875
How to fight back against Google FLoC
Here’s a closer look at Google’s Federated Learning of Cohorts (FLoC) initiative and how you can fight back and opt-out as a web user and a web developer.
2876
United States wants HTTPS for all government sites, all the time
The Sophos Blog
2877
In China, Your Credit Score Is Affected by Your Political Opinions
China's social score system is full of rumor and speculation. We clear up the misconceptions and explain how the credit system really works.
2878
GKE Sandbox: Independent operating system kernel to each container
Help lock down your containers with these Kubernetes Engine features and guidance
2879
2880
Exploiting null-dereferences in the Linux kernel
Posted by Seth Jenkins, Project Zero For a fair amount of time, null-deref bugs were a highly e...