8011
NBC.com hacked, serving up Citadel malware
A few hours ago Ronald Prins of Fox-IT (@cryptoron) was tweeting about NBC.com infecting its visitors with malicious software (malware). We were investigating this as well and found the following i…
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,773 posts.
8012
We busted a fake Chrome extension that was trying to steal data
A mysterious (and fake) Chrome extension. A clever data exfiltration scheme. They would have gotten away with it, too, if it weren't for those meddling security analysts using ExtraHop Reveal(x)! Follow along as we go from threat detection to response in this real-life threat hunt with network traffic analysis.
8013
One Year After ‘The Big Hack’
Today marks the one-year anniversary of Bloomberg’s publication of a story about Chinese intelligence intercepting the supply chain of Supermicro, a company which has built and sold servers to Amazon, Apple, the U.S. Department of Defense, and dozens of other companies. Apparently, they developed a chip that looked…
8014
On Web Extensions shortcomings and their impact on add-on security
Recently, I reported a security issue in the new Firefox Screenshots feature (fixed in Firefox 56). This issue is remarkable for a number of reasons. First of all, the vulnerable code was running within the Web Extensions sandbox, meaning that it didn’t have full privileges like regular Firefox code. This code was…
8015
Some OS X Applications Vulnerable to MITM Attacks
Facebook bug bounty and story behind a vulnerability
8016
Hopefully the last post I'll ever write on Dual EC DRBG
I’ve been working on some other blog posts, including a conclusion of (or at least an installment in) this exciting series on zero knowledge proofs. That’s coming soon, but first I want…
8017
Canary Watch, One Year Later
We announced Canary Watch a year ago as a coalition project to list Warrant Canaries and monitor them for changes or removal. Canary Watch was a joint project, with EFF, Freedom of the Press Foundation, NYU Law, Calyx and the Berkman Center.Along the way, the project has been part of the massive...
8018
UK courts have not been forthcoming with access to website blocking orders
A few weeks ago, ORG published the website 451unavailable.
8019
HTTP/2 Rapid Reset: deconstructing the record-breaking attack
This post dives into the details of the HTTP/2 protocol, the feature that attackers exploited to generate the massive Rapid Reset attacks
8020
Concrete: A fully homomorphic encryption compiler
An introduction on how to use the Zama Concrete open source TFHE compiler
8021
Keycloak open redirect: wildcard redirect URIs can be exploited to steal tokens
CVE-2023-6927 Keycloak vulnerability allows bypassing redirect URI validation which can be used as a vector for stealing authorization codes, access tokens and be used to redirect victims to arbitrary hosts.
8022
Looking into the Nintendo Alarmo
While everyone was waiting on news for the successor of the Nintendo Switch, Nintendo released the Alarmo. A small plastic alarm clock that ...
8023
EFF, Access Now, and the White House Sat Down to Talk About Encryption
In the public battle for strong encryption, EFF has championed the voice of everyday Internet users. After all, if we can’t rely on the security of our digital communications, how can the Web continue to grow and thrive? Now the fight has moved to the Oval Office. EFF, Access Now, over a dozen...
8024
Locking down your GitHub-hosted Domains
The other day someone claimed a hostname on a domain I own and it took me a while to track down how. Turns out it was via GitHub pages.
8025
8026
8027
Government Succeeds in Stalling Again, but Jewel V. NSA Goes On
We were disappointed today to learn that a federal appeals court in Pasadena declined to consider EFF’s appeal of a ruling in Jewel v. NSA, our long-running lawsuit battling unconstitutional mass surveillance of Internet and phone communications. While we are disappointed that government’s stall...
8028
Cloudflare's Handling of an RCE Vulnerability in Cdnjs
Recently, a RCE vulnerability in the way cdnjs’ backend is automatically keeping web resources up to date has been disclosed. Read about how Cloudflare handled the security incident and what will prevent similar exploits in the future.
8029
Arti, a pure-Rust Tor implementation
Greetings! Today I'm happy to announce a new era in Tor implementation. Over the past year or so, we've been working on "Arti", a project to rewrite Tor in Rust. Thanks to funding from Zcash Open Major Grants (ZOMG), we can finally put the Arti project up in our priorities list, and devote more time to it. Below I'll…
8030
Why does storing 2FA codes in your password manager make sense?
Modern login systems require a second factor (2FA) to log in, in addition to the standard username and password combination. A Time-based one-time password (TOTP) as a 6-digit number is often used. Password managers like [1Password](https://1password.com/), [KeePass (or respective forks)](https://keepass.info/) and…
8031
Apple Silicon MacBook batteries can't be replaced under warranty by third party
I bought a new M1 MacBook Pro in April 2022. A little over two years later, I'm seeing a service recommended message, and the maximum capacity of the battery is now down to 78%. Admittedly, my MacBook Pro experiences heavy usage: basically all day, every day. The batteries in my previous 2014 Intel MacBook Pro, which…
8032
A free and open internet shouldn't come at the expense of privacy
MARK SURMAN, PRESIDENT, MOZILLA Keeping the internet, and the content that makes it a vital and vibrant part of our global society, free and accessible has
8033
Finding an authorization bypass on my own website
The mysqljs parameterized query parser handles objects as column name and key, leading to alterations of the query.
8034
Maintaining Digital Certificate Security
Posted by Adam Langley, Security Engineer On Friday, March 20th, we became aware of unauthorized digital certificates for several Google ...
8035
An AWS account just for getting into other AWS accounts
“An AWS account just for getting into other AWS accounts” has moved to https://src-bin.com/substrate/blog/an-aws-account-just-for-getting-into-other-aws-accounts/ .
8036
8037
Coalition Announces New ‘Do Not Track’ Standard for Web Browsing (2015)
San Francisco - The Electronic Frontier Foundation (EFF), privacy company Disconnect and a coalition of Internet companies have announced a stronger “Do Not Track” (DNT) setting for Web browsing—a new policy standard that, coupled with privacy software, will better protect users from sites that try...
8038
Security Guidelines for Congressional Campaigns
Thank you for attending a training session! We covered a lot of ground, so these notes are meant to serve as a reference and reminder of the advice we gave you.
8039
TOFU: Do You Check?
Let’s say you’re on a fresh machine. Maybe you’ve just started a new job or you’ve wiped your machine. You’re about to push some code you’ve written and you get this: $ git push The authenticity of host 'github.com (140.82.121.4)' can't be established. ED25519 key fingerprint is…
8040
