91
Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures
Simon Rohlmann, Vladislav Mladenov, Christian Mainka, Daniel Hirschberger, and Jörg Schwenk, Ruhr University Bochum
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 317 posts.
92
Android 14 blocks all modification of system certificates, even as root?
Update: This post sparked a lot of excellent discussion and debate on workarounds, and there are now multiple working solutions to allow certificate injection...
93
Compromised PyTorch-nightly dependency chain between December 25th – December 30
If you installed PyTorch-nightly on Linux via pip between December 25, 2022 and December 30, 2022, please uninstall it and torchtriton immediately, and use the latest nightly binaries (newer than...
94
Mullvad Browser
We have partnered with Mullvad VPN to develop the Mullvad Browser - a Tor Browser without Tor
95
FCC Considering Banning Transfer of Online Consent Forms
Editor’s note: this version was updated at 6:00 pm pacific to include a couple of paragraphs that were omitted from the original post. Also–HI to all the thousands of regular people coming to visit today. I get it–we ALL hate unwanted calls and texts. But destroying the infrastructure of connecting consumers with…
96
Malicious VSCode extensions with more than 45k installs
Highlights: CloudGuard Spectral detected malicious extensions on the VSCode marketplace Users installing these extensions were enabling attackers to steal %
97
Making it clear when we're on a call with you to protect you from fraud
If someone calls you claiming to be from Monzo, you can now check to see if they’re telling the truth or not in the Monzo app.
98
99
Fake recruiter lured aerospace employee with trojanized coding challenge
ESET researchers uncover a Lazarus attack against an aerospace company in Spain, where the group deployed several tools, including a publicly undocumented backdoor we named LightlessCan.
100
FISA "reform" bill would greatly expand the entities forced to surveil users
Yesterday the House Permanent Select Committee on Intelligence unanimously approved the FISA Reform and Reauthorization Act of 2023 (FRRA), which would reauthorize Section 702 of the Foreign Intelligence Surveillance Act (FISA 702). The full House is expected to vote on this bill next Tuesday. Like other competing…
101
102
Mullvad becomes highest level of Tor Member (Shallot)
Mullvad has been a Tor Project Vidalia Onion Member since 2021 and has now become a Shallot Onion Member of Tor.
103
CircleCI security alert: Rotate any secrets stored in CircleCI
Read CircleCI’s security alerts from January 2023. Last updated 1/13/2023.
104
We tried to book a train ticket and ended up with a 245k records data breach
Dieser Artikel ist auch auf deutsch erschienen To celebrate Franco-German friendship, German Transport Minister Wissing and his French counterpart Beaune came up with something special: 30,000 free Interrail tickets per country for travel in Germany and France for young adults between 18 and 27. Codename: “Passe…
105
Passkeys are now enabled by default for Google users
Google is making it even easier to get started with passkeys by offering the ability to set them up for all users — by default.
106
Kids Online Safety Act is still a danger to our rights online
Are you a young person fighting back against bad bills like KOSA? Become an EFF member at a new, discounted Neon membership level specifically for you--stickers included! Congress has resurrected the Kids Online Safety Act (KOSA), a bill that would increase surveillance and restrict access to...
107
Meta prohibited from using personal data for advertisement
After almost five years, the Irish DPC decided on a noyb complaint and required Facebook, Instagram and WhatsApp to stop using the personal data of users for advertisement in the EU.
108
Removing support for forwarded ports
Today we announce that we no longer support port forwarding. New port forwards will no longer be supported, and existing ports will be removed 2023-07-01.
109
Quantum Resistance and the Signal Protocol
The Signal Protocol is a set of cryptographic specifications that provides end-to-end encryption for private communications exchanged daily by billions of people around the world. After its publication in 2013, the Signal Protocol was adopted not only by Signal but well beyond. Technical informat...
110
Compromised Microsoft key: More impactful than we thought
Our investigation of the security incident disclosed by Microsoft and CISA and attributed to Chinese threat actor Storm-0558, found that this incident seems to have a broader scope than originally assumed. Organizations using Microsoft and Azure services should take steps to assess potential impact.
111
Building end-to-end security for Messenger
We are beginning to upgrade people’s personal conversations on Messenger to use end-to-end encryption (E2EE) by default. Meta is publishing two technical white papers on end-to-end encryption: Our …
112
SMTP Smuggling – Spoofing Emails Worldwide
Introducing a novel technique for e-mail spoofing
113
First in-the-wild UEFI bootkit bypassing UEFI Secure Boot
ESET researchers are the first to publish an analysis of BlackLotus, the first in-the-wild UEFI bootkit capable of bypassing UEFI Secure Boot.
114
Mullvad Leta: A search engine used in the Mullvad Browser
Online privacy isn't just about a VPN. That’s why we have developed the Mullvad Browser.
115
Modernizing C arrays for greater memory safety: a case study in the Linux kernel
How to modernize C arrays for greater memory safety: a case-study in refactoring the Linux kernel and a look to the future Kees Cook C i...
116
An Update on the Lock Icon
Editor’s note: based on industry research (from Chrome and others), and the ubiquity of HTTPS, we will be replacing the lock icon in Chrome’...
117
Young people in 13 EU countries refuse surveillance of online communication
Poll: the 80% would not feel comfortable being politically active or exploring their sexuality if authorities can monitor their communication.
118
System76's coreboot open firmware manages to disable Intel ME for Raptor Lake
Read about the latest performance boosts, disabling Intel ME, Windows 11 support, and more!
119
Remote code execution in OpenSSH’s forwarded SSH-agent
CVE-2023-38408 is a remote code execution flaw in OpenSSH’s forwarded ssh-agent. Get full exploit details, impact analysis, and Qualys detection guidance.
120
Tailscale doesn't want your password
Tailscale ditches passwords for passkeys, offering a secure, phishing-resistant, and convenient way to authenticate. Learn how passkeys work, why they’re better than passwords, and how to set them up on your tailnet.