Every blog post that took off on Hacker News, ranked by the votes of its best submission. 536 posts.
I think turning everyday gadgets into bombs is a bad idea. However, recent news coverage has been framing the weaponization of pagers and radios in the Middle East as something we do not need to concern ourselves with because “we” are safe.
Law enforcement agencies in the United States and Europe today announced Operation Endgame , a coordinated action against some of the most popular cybercrime platforms for delivering ransomware and data-stealing malware. Dubbed “the largest ever operation against botnets,” the international effort is being billed as…
A USPS smishing attempt prompts the Akamai SIG to unearth shocking statistics: Illegitimate USPS domains see as much traffic as the legitimate USPS domain.
In the race to secure cloud applications, AWS Nitro Enclaves have emerged as a powerful tool for isolating sensitive workloads. But with great power comes great responsibility-and potential security pitfalls. As pioneers in confidential computing security, we at Trail of Bits have scrutinized the attack surface of AWS…
One weird hobby of mine is reasonable properties of cryptographic schemes that nobody promised they do or don’t have. Whether that’s invisible salamanders or binding through shared secr…
The amazingly scary xz sshd backdoor, Author: Bojan Zdrnja
In this post, we will look at how the security of the AES-GCM mode of operation can be completely compromised when a nonce is reused.
What are escape sequences
DigiCert will be revoking certificates that did not have proper Domain Control Verification (DCV). Before issuing a certificate to a customer, DigiCert validates the customer’s control or ownership over the domain name for which they are requesting a certificate using one of several methods approved by the CA/Browser…
Among the cryptographic missteps we see at Trail of Bits, “let’s build our own tool out of a hash function” is one of the most common. Clients have a problem along the lines of “we need to hash a bunch of different values together” or “we need a MAC” or “we need […]
OWASP Data Leak Notification on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.
This is an archive of an old whitepaper made by three reverse engineering experts on breaking down SecuROM and its multiple layers of protection. Archive Opening NotesAs mentioned, this is a whitepa
My computer on the net
Today we learn that Pavel Durov, founder of the popular messaging app Telegram, has been arrested as his private jet landed in France. Early indications are that the arrest stems from Telegram̵…
A post by Eshel Yaron with details and advice about a long standing arbitrary code execution vulnerability in Emacs
When it comes to designing secure protocols, I have a principle that goes like this: if you have to perform any cryptographic operation before verifying the MAC on a message you’ve received, it will somehow inevitably lead to doom.
The Consumer Finance Protection Bureau (CFPB) has just finalized a rule that makes it easy and safe for you to figure out which bank will give you the best deal and switch to that bank, with just a couple of clicks. We love this kind of thing: the coolest thing about a digital world is how easy it...
Instructions for building an affordable Faraday cage
Lineage OS is based on the Android Open-Source Project, whose primary maintainer is Google. To what extent can it be considered Google-free?
We are disclosing LeftoverLocals: a vulnerability that allows recovery of data from GPU local memory created by another process on Apple, Qualcomm, AMD, and Imagination GPUs. LeftoverLocals impacts the security posture of GPU applications as a whole, with particular significance to LLMs and ML models run on impacted…
ESET researchers analyzed previously unknown Linux backdoors that are connected to known Windows malware used by the China-aligned Gelsemium group, as well as to Project Wood.
Bitwarden includes a very handy integration called forwarded email aliases. Learn how to use the feature in this blog!
NORFOLK, Va.—Today, two Norfolk-area residents teamed up with the Institute for Justice (IJ) to file a federal lawsuit against the city, challenging the constitutionality of […]
Initial Disclosure: After extensive research, we have taken a short position in shares of Equinix, Inc. (NASDAQ:EQIX). This report represents our opinion, and we encourage every reader to do their own due diligence. Please see our full disclaimer at the bottom of the report.
Discover how Hardware Security Modules (HSMs) provide robust security solutions for managing cryptographic keys and protecting sensitive data in various industries.
Anthropic's new system, Clio, analyzes how people use AI while maintaining their privacy.
I had another instance of my Apple ID mysteriously being locked. First, my iPhone wanted me to enter the password again, which I thought was the “normal” thing it has done every few months, almost since I got it. But after doing so it said that my account was locked.
