211
Interoperability without sacrificing privacy: Matrix and the DMA
Matrix, the open protocol for secure decentralised communications
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 350 posts.
212
Attacking Titan M with Only One Byte
Following our presentation at Black Hat USA, in this blog post we provide some details on CVE-2022-20233, the latest vulnerability we found on Titan M, and how we exploited it to obtain code execution on the chip.
213
Apple neglects to patch two zero-day, wild vulnerabilities for Big Sur, Catalina
Apple has chosen to leave Big Sur and Catalina (around 35 to 40 percent of all Macs) in danger of actively exploited vulnerabilities that have only been patched for macOS Monterey.
214
Indian government withdraws Personal Data Protection Bill
The government has withdrawn the Personal Data Protection Bill, which had been in the works for three years, slamming the brakes indefinitely on privacy safeguards in India.
215
Requiring MFA on popular gem maintainers
News and updates from the RubyGems team — releases, security advisories, and project announcements.
216
Best Practices for Securing SSH
This article explores 5 SSH best practices you should observe to boost the security of your infrastructure.
217
Fog Revealed: A guided tour of how cops can browse your location data
In Part 1 of our series on Fog Data Science, we saw how when you give some apps permission to view your location, it can end up being packaged and sold to numerous other companies. Fog Data Science is one of those companies, and it has created a sleek search engine called Fog Reveal that allows cops to browse through…
218
Fuzzing rust-minidump for Embarrassment and Crashes – Part 2
For the last year, we've been working on the development of rust-minidump. The final part in this series takes you through fuzzing rust-minidump.
219
PyPI package 'secretslib' drops fileless Linux malware to mine Monero
Sonatype identified a 'secretslib' PyPI package that covertly installs cryptominers on Linux systems.
220
How we secure Monzo's banking platform
Our Security Infrastructure team introduces the principles we follow to build security in Monzo’s fast-moving engineering environment and how they work with other engineering teams to keep our customers and platform safe.
221
Lasershark: Fast, bidirectional communication into air-gapped systems
We present a novel approach to infiltrate data to air-gapped systems without any additional hardware on-site.
222
PyPI: Python packets steal AWS keys from users
Multiple Python packages caught by Sonatype were seen uploading secrets such as AWS keys and environment variables to a web endpoint.
223
Impact to DigitalOcean customers resulting from Mailchimp security incident
Today, we wanted to share an update about how DigitalOcean and our customers were impacted by a recent security incident disclosed by Mailchimp.
224
225
Global Encryption Day: Demand End-to-End Encryption in DMs
Today is Global Encryption Day, a day to highlight why encryption is critical for a safe, private internet.
226
Earn $200K by fuzzing for a weekend: Part 1
By applying well-known fuzzing techniques to a popular target, I found several bugs that in total yielded over $200K in bounties. In this article I will demonstrate how powerful fuzzing can be when applied to software which has not yet faced sufficient testing.
227
DNS-over-HTTP/3 in Android
Posted by Matthew Maurer and Mike Yu, Android team To help keep Android users’ DNS queries private, Android supports encrypted DNS. I...
228
A Year-End Letter from our Executive Director
This letter was originally published in our 2022 annual report. The past year at ISRG has been a great one and I couldn’t be more proud of our staff, community, funders, and other partners that made it happen. Let’s Encrypt continues to thrive, serving more websites around the world than ever before with excellent…
229
Protect your privacy and your phone number with Firefox Relay
When you share your personal phone number with anyone outside your circle of family and friends, it essentially gives them permission to call you anytime o
230
Another Vulnerability in the LPC55S69 ROM
The discovery of an undocumented hardware block in the LPC55S69.
231
Chaos Computer Club saves the German healthcare system 400M Euros
Zur Verbindung mit dem Gesundheitsdatennetz „Telematik“ sind in deutschen Arztpraxen spezielle Router vorgeschrieben. Nach nur fünf Jahren Laufzeit soll nun ein Gerätetausch alternativlos sein – so...
232
Mullvad Privacy Companion is now open source
Mullvad Privacy Companion, a free Firefox extension helping to improve your online privacy – is now open source.
233
Mitmproxy 9: WireGuard Mode
We’re excited to announce the release of mitmproxy 9, a free and open source interactive HTTPS proxy. This release brings support for raw UDP and DTLS, a new WireGuard proxy mode, and major usability improvements.
234
Why to not use JWT (2021)
We build advanced web apps
235
Spring Core on JDK9 is vulnerable to remote code execution
Update: March 31, 2022 A patch has officially been released. https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement https://tanzu.vmware.com/security/cve-2022-22965 Overview Spring Core on JDK9+ is vulnerable to remote code execution due to a bypass for CVE-2010-1622. At the time of writing, this…
236
A planned EU regulation about website certificates is causing concern
Feisty Duck’s Cryptography & Security Newsletter is a periodic dispatch bringing you commentary and news surrounding cryptography, security, privacy, SSL/TLS, and PKI. It's designed to keep you informed about the latest developments in this space. Enjoyed every month by more than 50,000 subscribers. Written by Hanno…
237
Rolling-PWN vulnerability affects all Honda vehicles
Modern vehicles are often equipped with a remote keyless entry system. These RKE systems allow unlocking or starting the vehicle remotely. The goal of our research was to evaluate the resistance of a modern-day RKE system. Our research disclosed a Rolling-PWN attack vulnerability affecting all Honda vehicles currently…
238
Bluetooth signals can be used to identify and track smartphones
A team of engineers at the University of California San Diego has demonstrated for the first time that the Bluetooth signals emitted constantly by our mobile phones have a unique fingerprint that can be used to track individuals’ movements.
239
Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare
Any website can use a simple API to replace CAPTCHAs with our invisible alternative, whether they’re on the Cloudflare network or not.
240
Malvertising on Microsoft Edge's news feed pushes tech support scams
While Google Chrome still dominates as the top browser, Microsoft Edge, which is based on the Chromium source code, is gradually gaining more...