Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,772 posts.
Multiple recent reports on serious security vulnerabilities in cable modems and routers paint a dire picture of the state of security of the devices that millions of users depend upon to connect to the Internet. Such vulnerabilities can be exploited to disable our access, snoop on our personal...
The PHP Foundation — Supporting, Advancing, and Developing the PHP Language
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
Binary Security found the undocumented APIs for Azure API Connections. In this post we examine the inner workings of the Connections allowing us to escalate privileges and read secrets in backend resources for services ranging from Key Vaults, Storage Blobs, Defender ATP, to Enterprise Jira and SalesForce servers.
We recently designed a new system to manage secret information safely – from the keys that we use to sign your Mastercard transactions, to credentials for external services.
Posted by Neil Martin, Export Compliance Counsel, Google Legal Tim Willis, Hacker Philanthropist, Chrome Security Team Cross-posted on...
Discover how BeyondCorp assists in securely restricting access to internal websites, ensuring organizational data remains protected.
Continuing the Chrome extension hacking (see part 1 and 2), this time I'd like to draw you attention to the oh-so-popular AdBlock extension. It has over a million users, is being actively maintained and is a piece of a great software (heck, even I use it!). However - due to how Chrome extensions work in general it is…
No organization has fully implemented zero trust architecture. Many advocates, including the US government, overlook devices as a key BeyondCorp component.
UPDATE (10/28/2019): We've revised the 2nd and 3rd bullet points in the section "How to Prepare; Known Complexities" below. In May, Chrome ...
Find bugs faster with ScanSearch. Discover forgotten assets, shadow IT, and expanded attack surfaces for bug bounty hunting.
Update 20151216: This quick post got far more attention than expected. I regret not mentioning that the leakage can easily be prevented via a setting. In practice the problem remains, users in general will have no idea about this being a relevant setting to change and will stay with the default. The best discussion on…
Space Cybersecurity has become a prominent topic in the news, particularly when it comes to protecting space-related assets and technologies.
FiveM provides a powerful framework to create game experiences not otherwise possible in Grand Theft Auto. However, this power can be abused by attackers through the use of XSS in vulnerable NUI resources.
how to hide juicy data in plain sight
Over the past six months, “fans” of this Web site and its author have shown their affection in some curious ways. One called in a phony hostage situation that resulted in a dozen heavily armed police surrounding my home . Another opened a $20,000 new line of credit in my name. Others sent more than $1,000 in bogus…
GO binaries are weird, or at least, that is where this all started out. While delving into some Linux malware named Rex, I came to the realization that I might need to understand more than I wanted to
In April of this year, FreeBSD patched a 13-year-old heap overflow in the Wi-Fi stack that could allow network-adjacent attackers to execute arbitrary code on affected installations of FreeBSD Kernel. This bug was originally reported to the ZDI program by a researcher known as m00nbsd and patched in
My list of “Probably Are Gonna Need It” security features for your web app – things that you should build up-front, not wait until you need them (when it’s already too late).
We are proud to announce PyPI's first external security audit.
Craig Gentry on board the mothership. (credit) A couple of weeks ago I polled readers for the subjects that they were interested in. You gave me some excellent responses, and I promise they’r…
David Schütz's bug bounty writeups
(Update: we've added a few engineers who asked to sign on right as the letter was going out; the final count is 96 signatures) Today, 87 prominent Internet engineers sent a joint letter the US Senate Judiciary Committee, declaring their opposition to the "Combating Online Infringement and...
FuzzDB is an open source database of attack patterns, predictable resource names, regex patterns for identifying interesting server responses, and documentation resources. It's most often used testing the security of ...
