151
152
Targeting HTTP's Hidden Attack-Surface
Modern websites are browsed through a lens of transparent systems built to enhance performance, extract analytics and supply numerous additional services. This almost invisible attack surface has been
153
FreeOTP – An open-source solution for authentication soft tokens
freeOTP is a soft token authenticator that can be used for two-factor authentication, and is available as a free Android app or iOS app. Two-factor authentication — requiring a user to have “something you have”, as well as “something you know” i.e. a password — is being supported on many more services these days…
154
Attacking the Windows Nvidia Driver
Posted by Oliver ChangModern graphic drivers are complicated and provide a large promising attack...
155
OpenSSL Licensing Update
The following is a press release that we just released, with the cooperation and financial support of the Core Infrastructure Initiative and the Linux Foundation.
156
Comma Separated Vulnerabilities
A Accenture oferece oportunidades que surgem a partir da disrupção tecnológica em todas as indústrias, em todos os países, todos os dias. Saiba mais!
157
Dumping a PS4 Kernel in “Only” 6 Days
What if a secure device had an attacker-viewable crashdump format? What if that same device allowed putting arbitrary memory into the crashdump? Amazingly, the ps4 tempted fate by supporting both of these features! Let’s see how that turned out…
158
Ways we harden our KVM hypervisor at Google Cloud: Security in plaintext
Google Cloud uses the open-source KVM hypervisor that has been validated by scores of researchers as the foundation of Google Compute Engine and Google Container Engine , and invests in additional security hardening and protection based on our research and testing experience. Then we contribute back our changes to the…
159
Containers Come to Firefox Test Pilot
The Containers feature in Firefox Nightly gives users the ability to place barriers on the flow of data across sites by isolating cookies, indexedDB, localStorage, and caches within discrete browsing ...
160
No boundaries: Exfiltration of personal data by session-replay scripts
This is the first post in our “No Boundaries” series, in which we reveal how third-party scripts on websites have been extracting personal information in increasingly intrusive ways. [0] by Steven Englehardt, Gunes Acar, and Arvind Narayanan Update: we’ve released our data — the list of sites with session-replay…
161
Exploiting the Linux kernel via packet sockets
Guest blog post, posted by Andrey KonovalovIntroductionLately I’ve been spending some time ...
162
Microsoft didn’t sandbox Windows Defender, so I did
Microsoft exposed their users to a lot of risks when they released Windows Defender without a sandbox. This surprised me. Sandboxing is one of the most effective security-hardening techniques. Why did Microsoft sandbox other high-value attack surfaces such as the JIT code in Microsoft Edge, but leave Windows Defender…
163
Basic Security Precautions for Non-Profits and Journalists
Basic security precautions for non-profits and journalists in the United States, early 2019.
164
Ubuntu Systemd Vulnerability
Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things.
165
166
Unikernels are secure
Per Buer is the CEO of IncludeOS . IncludeOS is a clean-slate unikernel written in C++ with performance and security in mind. Per Buer is the founder and previous CEO/CTO of Varnish Software.
167
Dutch Data Protection Authority: Microsoft breaches law with Windows 10
Met deze test controleren we of u een mens bent. Hiermee voorkomen we ongeoorloofd gebruik van deze dienst.
168
Sinking container ships by hacking load plan software
In my previous article, we looked at the easiest route on to a ships network – the satcoms system. Even having compromised that, it could be a challenge to affect the ship’s navigation, propulsion and control systems – most of these networks are at least somewhat segregated from one another. That got me thinking about…
169
Why TLS 1.3 isn't in browsers yet
Upgrading a security protocol in an ecosystem as complex as the Internet is difficult. You need to update clients and servers and make sure everything in between continues to work correctly. The Internet is in the middle of such an upgrade right now.
170
EFF’s “Spying on Students” Report Highlights Tech Companies’ Data Collection
San Francisco—School children are being spied on by tech companies through devices and software used in classrooms that often collect and store kids’ names, birth dates, browsing histories, location data, and much more—often without adequate privacy protections or the awareness and consent of...
171
Multiple vulnerabilities in RubyGems
There are multiple vulnerabilities in RubyGems bundled by Ruby.It is reported at the official blog of RubyGems.
172
173
174
How the NSA obtains and uses airline reservations (2013)
A front-page report in today’s New York Times based on documents leaked by NSA whistleblower Edward Snowden confirms that the NSA, like the DHS, uses airline reservation data as part of its profiling and social network analysis of US citizens and foreigners. Today’s report also raises new questions, and suggests some…
175
Exploiting the Wi-Fi Stack on Apple Devices
Posted by Gal Beniamini, Project ZeroEarlier this year we performed research into Broadcom’...
176
177
Dutch House of Representatives passes dragnet surveillance bill
On February 14, 2017 the bill for the new Intelligence and Security Services Act was passed by the Dutch lower house. Despite being met with serious opposition from experts, regulators, civil society, political parties and citizens, the revised bill passed virtually unchanged from the proposal submi
178
How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern
In April of 2016 Etsy launched Pattern, a new product that gives Etsy sellers the ability to create their own hosted e-commerce...
179
180
Using Binary Diffing to Discover Windows Kernel Memory Disclosure Bugs
Posted by Mateusz Jurczyk of Google Project ZeroPatch diffing is a common technique of comparing ...