511
About rel=noopener (2016)
2021 update: Browsers now implicitly set rel=noopener for any target=_blank link, following a spec change . If the demo on this page no longer seems scary, congratulations — you’re using a modern browser!
512
We busted a fake Chrome extension that was trying to steal data
A mysterious (and fake) Chrome extension. A clever data exfiltration scheme. They would have gotten away with it, too, if it weren't for those meddling security analysts using ExtraHop Reveal(x)! Follow along as we go from threat detection to response in this real-life threat hunt with network traffic analysis.
513
Coalition Announces New ‘Do Not Track’ Standard for Web Browsing (2015)
San Francisco - The Electronic Frontier Foundation (EFF), privacy company Disconnect and a coalition of Internet companies have announced a stronger “Do Not Track” (DNT) setting for Web browsing—a new policy standard that, coupled with privacy software, will better protect users from sites that try...
514
515
516
Secure Boot in the Era of the T2
Explore the Duo Blog for expert tips, security insights, and resources to stay updated on the latest in security and access management trends.
517
Domain hacks with unusual Unicode characters
Unicode contains a range of symbols which don't get much use. For example, there are separate symbols for TradeMark - ™, Service Mark - ℠, and Prescriptions - ℞. Nestling among the "Letterlike Symbols" are two curious entries. Both of these are single characters: Telephone symbol - ℡ Numero Sign - № What's interesting…
518
Root Cause of Reboot Issue Identified; Updated Guidance
Intel Newsroom delivers the latest news, announcements, and updates. Stay informed on Intel innovations.
519
F-Secure Anti-Virus: Remote Code Execution via Solid RAR Unpacking
Blog about anti-virus software vulnerabilities.
520
LaTeX TikZ for Cryptographers
LaTeX Code for Cryptographic Images.
521
522
Detecting Spectre and Meltdown Using Hardware Performance Counters
Security pros have been working on a new hardware attack type that exploits cache side-effects and speculative execution to perform privileged memory disclosure.
523
Learning Bluetooth Hackery with BLE CTF
Do you want to get into tinkering and hacking Bluetooth LE devices? Up until now, doing so was very much a DIY process. You would h...
524
525
A Few Thoughts on Ray Ozzie’s “Clear” Proposal
Yesterday I happened upon a Wired piece by Steven Levy that covers Ray Ozzie’s proposal for “CLEAR”. I’m quoted at the end of the piece (saying nothing much), so I knew the piece was coming. …
526
The Evil Within the Comparison Functions
Perhaps, readers remember my article titled Last line effect. It describes a pattern I′ve once noticed: in most cases programmers make an error in the last line of similar text blocks. Now I want...
527
Securing your users' authentication
A few days ago, I saw an article about someone’s Playstation Network account getting stolen . The problem wasn’t so much that the account got stolen, as this apparently happens more often than not, but that Sony has created a system so convoluted that it’s possible for the thief to keep your account, without you…
528
Android Security Auditing: Investigating Unauthorized Screenshots
About six months ago, I discovered something on my smartphone that horrified me: I went to undelete a file in DiskDigger, and I stumbled upon a plethora of unexpected jpegs: screenshots of my activity. Screenshots that I didn’t take. Screenshots of my conversations. Screenshots of my GPS position. And screenshots of…
529
530
531
The real reason for large DDoS attacks? It's IP Spoofing, not memcached
A week ago we published a story about new amplification attacks using memcached protocol on UDP port 11211. A few things happened since then: Github announced it was a target of 1.3Tbps memcached attack. OVH and Arbor reported similar large attacks with the peak reported at 1.7Tbps.
532
533
EnclaveDB: A secure database using SGX
EnclaveDB: A secure database using SGX Priebe et al., IEEE Security & Privacy 2018 This is a really interesting paper (if you’re into this kind of thing I guess!) bringing together the security…
534
Implementing Open Source Container Security, Part 1: Runtime Security
Expert insight, best practices, and advice on Secure DevOps, security for containers, Kubernetes, and cloud services. Review Sysdig blog posts today!
535
Evolving Chrome's security indicators
Previously, we posted a proposal to mark all HTTP pages as definitively “not secure” and remove secure indicators for HTTPS pages. HTTPS us...
536
537
Notes on Analytics and Tracking in Onavo Protect for iOS
Recent media coverage of Onavo Protect encouraged me to investigate the code for the iOS version of their app. I wanted to determine what…
538
Better slow than sorry – VirtualBox 3D acceleration considered harmful
The 3 - d acceleration feature of VirtualBox has had a bit of a rough time this year . One could argue that technically this component might not be considered attack surface in VirtualBox, due to the big warning put out in the documentation recommending against its use (emphasis mine):
539
Systemd's DynamicUser feature is currently dangerous
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
540
Protecting GDPR Personal Data with Pseudonymization
If you’ve had the chance to read our GDPR white paper or our previous GDPR primer blog post, you’ve, no doubt, seen the word "pseudonymization" used extensively to describe one technical measure that ...