61
Threat actor abuses Cloudflare tunnels to deliver remote access trojans
Key findings Proofpoint has observed an increase in malware delivery via TryCloudflare Tunnel abuse. The activity is financially motivated and delivers exclusively remote
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 257 posts.
62
Sharing details on a recent incident impacting one of our customers
Google Cloud shares details of an incident impacting one Australian customer's use of Google Cloud VMware Engine. Learn what happened and how we're preventing it from happening again.
63
AirPods fast connect security vulnerability
tldr: There's a security vulnerability (CVE-2024-27867) in the firmware of Apple AirPods. Anyone who knows the Bluetooth MAC address (which is somewhat public) can connect to your AirPods and listen to the microphone or play music. Even while the AirPods are connected to your phone (although music would stop playing…
64
Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US
Met deze test controleren we of u een mens bent. Hiermee voorkomen we ongeoorloofd gebruik van deze dienst.
65
Cloudflare loses 22% of its domains in Freenom .tk shutdown
A staggering 12.6 million domains on TLDs controlled by Freenom (.tk, .cf and .gq) have been shut down and no longer resolve, leading to a significant reduc ...
66
Unfashionably secure: why we use isolated VMs
Why we use isolated VMs as a hard security boundary.
67
How we applied fuzzing techniques to cURL
Near the end of 2022, Trail of Bits was hired by the Open Source Technology Improvement Fund (OSTIF) to perform a security assessment of the cURL file transfer command-line utility and its library, libcurl. The scope of our engagement included a code review, a threat model, and the subject of this blog […]
68
German credit agency earns millions through unlawful customer manipulation
The comapny uses manipulative designs to prevent people from obtaining a free copy of their data in accordance with law
69
Alignment faking in large language models
A paper from Anthropic's Alignment Science team on Alignment Faking in AI large language models
70
Security research on Private Cloud Compute
Private Cloud Compute (PCC) fulfills computationally intensive requests for Apple Intelligence while providing groundbreaking privacy and security protections — by bringing our industry-leading device security model into the cloud. To build public trust in our system, we’re making it possible for researchers to…
71
Gaining kernel code execution on an MTE-enabled Pixel 8
In this post, I’ll look at CVE-2023-6241, a vulnerability in the Arm Mali GPU that allows a malicious app to gain arbitrary kernel code execution and root on an Android phone. I’ll show how this vulnerability can be exploited even when Memory Tagging Extension (MTE), a powerful mitigation, is enabled on the device.
72
Secure Randomness in Go 1.22
ChaCha8Rand is a new cryptographically secure pseudorandom number generator used in Go 1.22.
73
WPA3 Enterprise 192-bit mode at home
For our 2023 holiday project, we're setting up an WPA3 Enterprise certificate-authenticated Wi-Fi network at home! And when your family from out of town asks to "jump on the Wi-Fi real quick," you'll learn why this type of network is such a hassle to manage.
74
Cloudflare Announces Firewall for AI
Cloudflare is one of the first providers to safeguard LLM models and users in the era of AI
75
Mozilla Monitor Plus: automatically remove your personal info from data brokers
Today, Mozilla Monitor (previously called Firefox Monitor), a free service that notifies you when your email has been part of a breach, announced its new p
76
Vulnerabilities in the Feeld dating app
Discover critical Feeld app vulnerabilities from our pentest. See how flaws in security controls expose personal data and learn key fixes.
77
Over 100k Infected Repos Found on GitHub
Secure everything coding agents build, use, and ship - prevent risk before code exists, AutoFix the backlog, and protect the coding agents and supply chain.
78
European govt air-gapped systems breached using custom malware
ESET Research analyzed two separate toolsets for breaching air-gapped systems, used by a cyberespionage threat actor known as GoldenJackal.
79
Microsoft actions following attack by nation state actor Midnight Blizzard
Microsoft Security Response Center Blog
80
The V8 Sandbox
V8 features a lightweight, in-process sandbox to limit the impact of memory corruption bugs
81
Entrust Certificate Distrust
Posted by Chrome Root Program, Chrome Security Team Update (09/10/2024): In support of more closely aligning Chrome’s planned compliance ...
82
We hacked Google A.I.
Bard IDOR, a GraphQL directive-overloading DoS that hung Google's backend for 109 seconds, and Workspace data exfiltration via markdown images.
83
Make your electronics tamper-evident
If the police ever have physical access to an electronic device like a laptop, even for five minutes , they can install hardware keyloggers, create images of the storage media, or otherwise trivially compromise it at the hardware, firmware, or software level. One way to minimize this risk is to make devices…
84
85
How we found and fixed an eBPF Linux kernel vulnerability
This blog post takes a look at the years where eBPF was one of the kernel subsystems that grabbed the attention of a lot of security researchers. We will tell the story of how we discovered CVE-2023-2163, what our root-cause analysis process looked like, and what we did to ultimately fix the issue.
86
Bypassing Safari 17's advanced audio fingerprinting protection
Explore how Safari 17’s new anti-fingerprinting techniques affect audio fingerprinting and browser differentiation.
87
Macaroons Escalated Quickly
Documentation and guides from the team at Fly.io.
88
0day Contest for End-of-Life Devices Announced
The Junkyard contest focuses on deprecated systems, responsible disclosure, and meme-worthy exploits. Join us today!
89
Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
a post going over 4 exploits for CVE-2024-20017, a remotely exploitable buffer overflow in a component of the MediaTek MT7622 SDK.
90
Hacking misconfigured AWS S3 buckets: A complete guide
AWS S3 (Simple Storage Service) buckets are a popular storage service used by software companies and organizations to store public as well as sensitive data. However, the implementation of this servic...