61
62
iOS 11's Misleading "Off-Ish" Setting for Radios Is Bad for User Security
Turning off your Bluetooth and Wi-Fi radios when you’re not using them is good security practice (not to mention good for your battery usage). When you consider Bluetooth’s known vulnerabilities, it’s especially important to make sure your Bluetooth and Wi-Fi settings are doing what you want them...
63
There are over a billion outdated Android devices in use
It's common knowledge that Android device tend to be more out of date than iOS devices, but what does this actually mean? Let’s look at android marketshare data to see how old devices in the wild are. The x axis of the plot below is date, and the y axis is Android marketshare. The share of all devices sums to 100%…
64
A Case of Stolen Source Code
Last week, for about three days, the macOS video transcoding app HandBrake was compromised . One of the two download servers for HandBrake was serving up a special malware-infested version of the app, that, when launched, would essentially give hackers remote control of your computer.
65
An in-depth security review of the Intel Management Engine
Security Center
66
CircleCI trusts 8 analytics companies with your source code and API tokens
When you navigate to your project in CircleCI's UI, Javascript from eight different analytics companies gets loaded and executed in your browser.
67
When it comes to internet privacy, be afraid, analyst suggests
Cybersecurity expert Bruce Schneier, a fellow with the Berkman Klein Center for Internet & Society, discusses what consumers can do to protect themselves from government and corporate surveillance.
68
CloudPets teddy bears leaked and ransomed, exposing kids' voice messages
Only a couple of weeks ago, there were a lot of news headlines about how Germany had banned an internet-connected doll called "Cayla" over fears hackers could target children [http://www.telegraph.co.uk/news/2017/02/17/germany-bans-internet-connected-dolls-fears-hackers-could-target/] . One of
69
70
IOHIDeous OS X Local Kernel Vulnerability
Siguza’s Blog
71
Keylogger in Hewlett-Packard Audio Driver
Security reviews of modern Windows Active Domain infrastructures are – from our point of view – quite sobering. Therefore, we often look left and right, when, for example, examining the hardening of protection mechanisms of a workstation. Here, we often find all sorts of dangerous and ill-conceived stuff. We want to…
72
Leaked document: EU Presidency calls for massive internet filtering
A Council of the European Union document leaked by Statewatch on 30 August reveals that during the summer months, that Estonia (current EU Presidency) has been pushing the other Member States to strengthen indiscriminate internet surveillance, and to follow in the footsteps of China regarding online censorship…
73
74
TP-Link firmware sends six DNS requests and one NTP query every 5 seconds
A design flaw in TP-Link Wi-Fi repeater firmware causes it to waste an excessive amount of bandwidth on NTP timekeeping. DDoS’ed public NTP servers in the process.
75
Secret Dots from Printer Outed NSA Leaker
Today, The Intercept released documents on election tampering from an NSA leaker. Later, the arrest warrant request for an NSA contractor ...
76
77
Firefox 57 delays requests to tracking domains
Firefox Quantum - version 57 - introduced number of changes to the network requests scheduler. One of them is using data of the Tracking Protection database to delay load of scripts from tracking domains when possible during the time a page is actively loading and rendering - I call it tailing. This has a positive […]
78
Technology preview: Private contact discovery for Signal
At Signal, we’ve been thinking about the difficulty of private contact discovery for a long time. We’ve been working on strategies to improve our current design, and today we’ve published a new private contact discovery service. Using this service, Signal clients will be able to efficiently and s...
79
What happens when you swipe a credit card
Ninety percent of Americans have used a credit card, but far fewer understand the underlying systems enabling their payments. So let’s dive…
80
How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security
How Chrome OS, Termux, YubiKey & Duo Mobile make for great usable security. A travel Chromebook for modern development, online and offline.
81
Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
Check Point researchers revealed a new attack vector which threatens millions of users worldwide – attack by subtitles. By crafting malicious subtitle %
82
iOS 11 Horror Story: The Rise and Fall of iOS Security
We loved what Apple used to do about security. During the past years, the company managed to build a complete, multi-layer system to secure its hardware and sof
83
Falling through the KRACKs
The big news in crypto today is the KRACK attack on WPA2 protected WiFi networks. Discovered by Mathy Vanhoef and Frank Piessens at KU Leuven, KRACK (Key Reinstallation Attack) leverages a vulnerab…
84
Examining a vintage RAM chip, I find a counterfeit with a different die inside
A die photo of a vintage 64-bit TTL RAM chip came up on Twitter recently, but the more I examined the photo the more puzzled I became. The c...
85
Chrome's Plan to Distrust Symantec Certificates
Posted by Devon O’Brien, Ryan Sleevi, Andrew Whalley, Chrome Security This post is a broader announcement of plans already finalized on t...
86
Exploding Git Repositories
The git bomb. Crafting compact repos that can't be cloned.
87
Escaping Docker container using waitid() – CVE-2017-5123
Prisma Cloud is the most complete Cloud Native Application Protection Platform (CNAPP) for code to cloud security in any cloud, multicloud, and hybrid environment.
88
89
How to use BeyondCorp to ditch VPN, improve security and go to the cloud
The BeyondCorp security engineering team at Google just announced their fourth research paper.
90
Why ProtonMail is more secure than Gmail
Proton Mail is a private email service takes a radically different approach to security. Find out how Proton Mail security compares to Gmail security.