361
362
363
Hacking a cheap fitness tracker bracelet
A blog post on reverse engineering and customizing the firmware of a cheap fitness tracker bracelet.
364
Think You’ve Got Your Credit Freezes Covered? Think Again
I spent a few days last week speaking at and attending a conference on responding to identity theft. The forum was held in Florida, one of the major epicenters for identity fraud complaints in United States. One gripe I heard from several presenters was that identity thieves increasingly are finding ways to open new…
365
Protecting Mozilla’s GitHub Repositories from Malicious Modification
At Mozilla, we’ve been working to ensure our repositories hosted on GitHub are protected from malicious modification. As the recent Gentoo incident demonstrated, such attacks are possible. Mozilla’s original usage ...
366
367
A Call of Duty exploit
A few years ago, I became aware of a security issue in most Call of Duty games. Although I did not discover it myself, I thought it might be interesting to see what it could be used for. Without going into detail, this security issue allows users playing a Call of Duty match to cause a buffer overflow on the host’s…
368
How to build an NPM worm
npm is a registry and package manager for JavaScript that ships as part of Node.js . It's used by tens of millions of people to install hundreds of thousands of packages billions of times every week.
369
370
CloudFlair: Bypassing CloudFlare using Internet-wide scan data
Cloudflare is a service that acts as a middleman between a website and its end users, protecting it from various attacks. Unfortunately, those websites are often poorly configured, allowing an attacker to entirely bypass Cloudflare and run DDoS attacks or exploit web-based vulnerabilities that would otherwise be…
371
Download all of your GitHub data
Now you can request an archive of your data from your account settings page.
372
Fear the reaper: characterization and fast detection of card skimmers
Fear the reaper: characterization and fast detection of card skimmers Scaife et al., USENIX Security 2018 Until I can get my hands on a Skim Reaper I’m not sure I’ll ever trust an ATM or other expo…
373
Amazon S3 Block Public Access: Protection for Your Accounts and Buckets
Update (4/27/2023): Amazon S3 now automatically enables S3 Block Public Access and disables S3 access control lists (ACLs) for all new S3 buckets in all AWS Regions. Update (August 2019)– Fresh screen shots and changes to the names of the options. Newly created Amazon S3 buckets and objects are (and always have been)…
374
New “Terrorist Content” Regulations: A Grim Day for Digital Rights in Europe
Despite waves of calls and emails from European Internet users, the European Parliament today voted to accept the principle of a universal pre-emptive copyright filter for content-sharing sites, as well as the idea that news publishers should have the right to sue others for quoting news items...
375
Searching statically-linked vulnerable library functions in executable code
Helping researchers find 0ld daysPosted by Thomas Dullien, Project ZeroExecutive summarySoftware ...
376
OAuth for the Open Web
OAuth has become the de facto standard for authorization and authentication on the web. Nearly every company with an API used by third party developers has implemented OAuth to enable people to build apps on top of it.
377
Building a Titan: Better security through a tiny chip
At the Made by Google event last week, we talked about the combination of AI + Software + Hardware to help organize your information. To better protect that information at a hardware level, our new Pixel 3 and Pixel 3 XL devices include a Titan M chip.We briefly introduced Titan M and some of its benefits on our…
378
Approaching Access Control on the Web (Part I)
Learn how to build future-proof, state of the art login, access control and API security systems in this multipart series.
379
The Bare Minimum You Should Do to Protect Your Family's Data
For a lot of families, technology is the glue that holds everything together. There’s your kid’s Instagram feed you follow to see what theyR
380
Credit card thieves using free-to-play apps to launder their ill-gotten gains
This MacKeeper report will tell you about 6 major data breaches that happened in 2018.
381
Extracting SSH Private Keys from Windows 10 ssh-agent
The newest Windows 10 update includes OpenSSH utilities, including ssh-agent. Here’s how to extract unencrypted saved private keys from the registry
382
Supply Chain Security Is the Whole Enchilada, but Who’s Willing to Pay for It?
From time to time, there emerge cybersecurity stories of such potential impact that they have the effect of making all other security concerns seem minuscule and trifling by comparison. Yesterday was one of those times. Bloomberg Businessweek on Thursday published a bombshell investigation alleging that Chinese cyber…
383
384
385
386
WPA3 Wifi Security Protocol Announced
New Wi-Fi® security features available in 2018Las Vegas, NV – January 8, 2018 – Wi-Fi Alliance® introduces enhancements and new features for Wi-Fi Protected Access®, the essential family of Wi-Fi CERTIFIED™ security technologies for more than a decade. Wi-Fi Alliance is launching configuration, authentication, and…
387
A more privacy-friendly blog
Over the years, I have implemented some changes to this blog to make it more privacy-friendly.
388
389
Practical Web Cache Poisoning
In this paper I'll show you how to compromise websites by using esoteric web features to turn their caches into exploit delivery systems
390