151
Threat actor abuses Cloudflare tunnels to deliver remote access trojans
Key findings Proofpoint has observed an increase in malware delivery via TryCloudflare Tunnel abuse. The activity is financially motivated and delivers exclusively remote
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 536 posts.
152
EU: Users who refuse scanning to be prevented from sharing photos and links
The highly controversial indiscriminate child sexual abuse regulation (so-called chat control) could still be endorsed by EU governments after all, as France could give up its previous veto. This is reported by Euractiv and confirmed by internal documents. France considers the new "upload moderation
153
Cracking an old ZIP file to help open source the ANC's "Vula" secret crypto code
It's not often that you find yourself staring at code that few people have ever seen, code that was an important part in bringing down the a...
154
Sharing details on a recent incident impacting one of our customers
Google Cloud shares details of an incident impacting one Australian customer's use of Google Cloud VMware Engine. Learn what happened and how we're preventing it from happening again.
155
Mediocre Engineer's Guide to HTTPS
As a mediocre engineer, I took Internet and HTTPS communication for granted and never dove any deeper. Today we’re improving as engineers and learning a rough overview of how internet communication works, specifically focusing on HTTP and TLS.
156
157
Upcoming Hardening in PHP
Personal blog of Julien (jvoisin) Voisin
158
AirPods fast connect security vulnerability
tldr: There's a security vulnerability (CVE-2024-27867) in the firmware of Apple AirPods. Anyone who knows the Bluetooth MAC address (which is somewhat public) can connect to your AirPods and listen to the microphone or play music. Even while the AirPods are connected to your phone (although music would stop playing…
159
Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US
Met deze test controleren we of u een mens bent. Hiermee voorkomen we ongeoorloofd gebruik van deze dienst.
160
How an empty S3 bucket can make your AWS bill explode
Imagine you create an empty, private AWS S3 bucket in a region of your preference. What will your AWS bill be the next morning?
161
Hacking the largest airline and hotel rewards platform (2023)
Between March 2023 and May 2023, we identified multiple security vulnerabilities within points.com, the backend provider for a significant portion of airline and hotel rewards programs. These vulnerabilities would have enabled an attacker to access sensitive customer account information, including names, billing…
162
Hackers Steal Phone, SMS Records for Nearly All AT&T Customers
AT&T Corp. disclosed today that a new data breach has exposed phone call and text message records for roughly 110 million people — nearly all of its customers. AT&T said it delayed disclosing the incident in response to “national security and public safety concerns,” noting that some of the records included data that…
163
Cloudflare loses 22% of its domains in Freenom .tk shutdown
A staggering 12.6 million domains on TLDs controlled by Freenom (.tk, .cf and .gq) have been shut down and no longer resolve, leading to a significant reduc ...
164
Dumping Memory to Bypass BitLocker on Windows 11
Memory-Dump-UEFI is a UEFI application for dumping the contents of RAM.
165
EU Council to Vote on Chat Scanning Proposal on Thursday
🇫🇷 French: Traduction du dossier Chat Control 2.0, stopchatcontrol.fr🇸🇪 Swedish: Chat Control 2.0🇩🇰 Danish: chatcontrol.dk🇳🇱 Dutch: Chatcontrole Table of contents: The End of the Privacy of Digital Correspondence and the End of Anonymous Communication Take action to stop Chat
166
Forging signed commits on GitHub
Creating fake signed commits
167
OpenID Connect specifications published as ISO standards
I’m thrilled to report that the OpenID Connect specifications have now been published as ISO/IEC standards. They are:
168
Unfashionably secure: why we use isolated VMs
Why we use isolated VMs as a hard security boundary.
169
How we applied fuzzing techniques to cURL
Near the end of 2022, Trail of Bits was hired by the Open Source Technology Improvement Fund (OSTIF) to perform a security assessment of the cURL file transfer command-line utility and its library, libcurl. The scope of our engagement included a code review, a threat model, and the subject of this blog […]
170
German credit agency earns millions through unlawful customer manipulation
The comapny uses manipulative designs to prevent people from obtaining a free copy of their data in accordance with law
171
Alignment faking in large language models
A paper from Anthropic's Alignment Science team on Alignment Faking in AI large language models
172
Security research on Private Cloud Compute
Private Cloud Compute (PCC) fulfills computationally intensive requests for Apple Intelligence while providing groundbreaking privacy and security protections — by bringing our industry-leading device security model into the cloud. To build public trust in our system, we’re making it possible for researchers to…
173
Gaining kernel code execution on an MTE-enabled Pixel 8
In this post, I’ll look at CVE-2023-6241, a vulnerability in the Arm Mali GPU that allows a malicious app to gain arbitrary kernel code execution and root on an Android phone. I’ll show how this vulnerability can be exploited even when Memory Tagging Extension (MTE), a powerful mitigation, is enabled on the device.
174
The global surveillance free-for-all in mobile ad data
Not long ago, the ability to digitally track someone’s daily movements just by knowing their home address, employer, or place of worship was considered a dangerous power that should remain only within the purview of nation states. But a new lawsuit in a likely constitutional battle over a New Jersey privacy law shows…
175
Secure Randomness in Go 1.22
ChaCha8Rand is a new cryptographically secure pseudorandom number generator used in Go 1.22.
176
Protecting your email address via SVG instead of JavaScript
Conventionally, email addresses published on webpages may be protected from email-harvesting spambots via various HTML, CSS & JS-based techniques. This alternative technique is SVG-based.
177
U.S. Army Soldier Arrested in AT&T, Verizon Extortions
Federal authorities have arrested and indicted a 20-year-old U.S. Army soldier on suspicion of being Kiberphant0m , a cybercriminal who has been selling and leaking sensitive customer call records stolen earlier this year from AT&T and Verizon . As first reported by KrebsOnSecurity last month, the accused is a…
178
WPA3 Enterprise 192-bit mode at home
For our 2023 holiday project, we're setting up an WPA3 Enterprise certificate-authenticated Wi-Fi network at home! And when your family from out of town asks to "jump on the Wi-Fi real quick," you'll learn why this type of network is such a hassle to manage.
179
Cloudflare Announces Firewall for AI
Cloudflare is one of the first providers to safeguard LLM models and users in the era of AI
180
Hacking the T2S+ Out of Fear: Get Lock-In Thermography for Free
Hacking the T2S+ v2 to work on computers, tear it down for the first time online, and play with lock-in thermography as a bonus!