541
A survey of recent iOS kernel exploits
Posted by Brandon Azad, Project ZeroI recently found myself wishing for a single online reference...
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 612 posts.
542
GitLab acquires Peach Tech and Fuzzit
Acquisitions will make GitLab the first security solution to offer both coverage-guided and behavioral fuzz testing
543
TRRespass: Rowhammer against DDR4
Project Description Rowhammer haunted us for the better part of the past decade. Most DDR3 modules were found to be susceptible to this vulnerability which can compromise data directly inside the memory cells. What made it so scary was the fact that it could be exploited from software on PCs, clouds, smartphones, over…
544
SSH Keygen – RSA, DSA, Ecdsa, EdDSA
Comparing SSH keys: RSA, DSA, ECDSA, and Ed25519 explained, with a straight algorithm recommendation and the move from keys to certificates. Read on.
545
Linux kernel heap quarantine versus use-after-free exploits
It's 2020. Quarantines are everywhere – and here I'm writing about one, too. But this quarantine is of a different kind. In this article I'll describe the Linux Kernel Heap Quarantine that I developed for mitigating kernel use-after-free exploitation.
546
EFF to Supreme Court: Violating Terms of Service Isn’t a Crime Under the CFAA
Washington, D.C.—The Electronic Frontier Foundation (EFF) and leading cybersecurity experts today urged the Supreme Court to rein in the scope of the Computer Fraud and Abuse Act (CFAA)—and protect the security research we all rely on to keep us safe—by holding that accessing computers in ways that...
547
548
549
Body found in Canada identified as neo-nazi spam king
The body of a man found shot inside a burned out vehicle in Canada three years ago has been identified as that of Davis Wolfgang Hawke , a prolific spammer and neo-Nazi who led a failed anti-government march on Washington, D.C. in 1999, according to news reports.
550
Exploiting the Windows Cryptoapi Vulnerability
On Tuesday, the NSA announced they had found a critical vulnerability in the certificate validation functionality on Windows 10 and Windows Server 2016/2019. This bug allows attackers to break the validation of trust in a wide variety of contexts, such as HTTPS and code signing. Concerned? Get the important details…
551
US government-funded phones come pre-installed with unremovable malware
A US-funded government assistance program is selling budget-friendly mobile phones that come pre-installed with unremovable malicious apps.
552
Unlocking eBPF power
Spiral journey over kubernetes, cloud and devops world.
553
554
555
Safe-Linking – Eliminating a 20 year-old malloc() exploit primitive
Research by: Eyal Itkin Overview One of our goals for every research project we work on in Check Point Research is to get an intimate understanding of how software work: What components do they contain? Are they vulnerable? How can attackers exploit these vulnerabilities? And more importantly, how can we protect…
556
De-Anonymization via Clickjacking in 2019
This blog post is about my journey to understand the current practice of de-anonymization via the clickjacking technique whereby a malicious website is able to uncover the identity of a visitor, including his full name and possibly other personal information. I don’t present any new information here that isn’t already…
557
Introducing Semgrep and r2c
An extensible developer-friendly application security platform that scans source code to surface true and actionable security issues with AI-assisted SAST, SCA, and Secrets Detection solutions.
558
API Security Best Practices
Learn how to secure your API. Best practices for OAuth, REST, DDoS, Attack Mitigation and Design.
559
Zoom’s 90-day plan to bolster key privacy and security initiatives
Learn more about how to use each Zoom product to connect with coworkers, customers, businesses, and more with insights and best practices.
560
Macs with T2, M1 chips cannot be restored to factory state without Apple
Modern Apple computers can no longer be fully used and maintained in 100% offline environments, or in ways that will reasonably ensure that the computer is…
561
Microsoft Defender ATP for Linux is now generally available
Today we are excited to announce general availability of Microsoft Defender Advanced Threat Protection (ATP) for Linux! - This initial release delivers...
562
Jitsi Meet Security and Privacy
How secure is Jitsi? Learn more about the Jitsi Meet Security & Privacy information, including how we make sure to protect your privacy here.
563
A grim outlook on the future of browser add-ons
Mozilla limiting users’ choice to 9 add-ons on mobile is only the latest development. Add-on support is degrading across all browsers and will continue to do so.
564
565
Github: Token authentication requirements for Git operations
Beginning August 13th, 2021, we will no longer accept account passwords when authenticating Git operations on GitHub.com.
566
567
Mental health websites don't have to sell user data but most still do
The changes discussed in this article are based on a second analysis performed in late November, 3 months after the original study Your Mental Health is for Sale and following the exact same methodology.
568
More people are searching for an inbox that protects their privacy
Google searches for privacy-focused Gmail alternatives have steadily increased since 2019. We examine the numbers and potential reasons why.
569
What happens when a ccTLD is retired? Exploring the potential risks of .io
Could the complex political history of Diego Garcia put the .io domain at risk? Tech firms should be aware of potential risk to their websites.
570
