151
A cache invalidation bug in Linux memory management
Posted by Jann Horn, Google Project ZeroThis blogpost describes a way to exploit a Linux kernel b...
152
Google Home (in)Security
TL;DR: An undocumented API in Google home devices is easily exploitable. This command will reboot any on your local network: nmap –open -p 8008 192.168.1.0/24 | awk ‘/is up/ {print up};…
153
GrayKey iPhone unlocker poses serious security concerns
Ever since the case of the San Bernadino shooter pitted Apple against the FBI over the unlocking of an iPhone, opinions...
154
155
Twitter's Secret “Guest Mode”
Twitter has an undocumented feature which lets you follow accounts without being logged in. Here's how I found it, and how you can use it. My crappy old TV has a crappy old web browser on it. One boring Sunday, I decided to see which websites worked and which didn't on a 6 year old browser. Anything using LetsEncrypt…
156
Distrust of Symantec TLS Certificates
A Certification Authority (CA) is an organization that browser vendors (like Mozilla) trust to issue certificates to websites. Last year, Mozilla published and discussed a set of issues with one ...
157
158
Why Searching Through 500M Pwned Passwords Is So Quick
In the immortal words of Ricky Bobby, I wanna go fast [https://www.youtube.com/watch?v=_qJGsSuFRIg]. When I launched Pwned Passwords V2 last week [https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/], I made it fast - real fast - and I want to talk briefly here
159
TLS 1.3 and Proxies
I'll generally ignore the internet froth in a given week as much as possible, but when Her Majesty's Government starts repeating misunderstandings about TLS 1.3 it is necessary to write something, if only to have a pointer ready for when people start citing it as evidence.
160
Credit card fraud warning signs
Avoid accepting fraudulent credit card orders by paying attention to these warning signs.
161
Against privacy defeatism: why browsers can still stop fingerprinting
In this post I’ll discuss how a landmark piece of privacy research was widely misinterpreted, how this misinterpretation deterred the development of privacy technologies rather than spurring it, how a recent paper set the record straight, and what we can learn from all this. The research in question is about browser…
162
163
The ‘app’ you can’t trash: how SIP is broken in High Sierra
When you can’t remove an app which you installed just a few minutes ago, you know there’s something wrong. Here’s the solution, and why this is bad security.
164
Chinese Government Fabricates Social Media Posts for Strategic Distraction
The Chinese government has long been suspected of hiring as many as 2,000,000 people to surreptitiously insert huge numbers of pseudonymous and other deceptive writings into the stream of real social media posts, as if they were the genuine opinions of ordinary people. Many academics, and most journalists and…
165
Technology preview: Sealed sender for Signal
In addition to the end-to-end encryption that protects every Signal message, the Signal service is designed to minimize the data that is retained about Signal users. By design, it does not store a record of your contacts, social graph, conversation list, location, user avatar, user profile name, ...
166
167
So Your Startup Received the Nightmare GDPR Letter
Some dumb lawyer figured it would be fun to give GDPR trolls a form letter to use to inflict maximum damage on unsuspecting companies. The reason why this is dumb is simple: the GDPR serves a legitimate need but by decreasing the signal:noise ratio handcrafted requests from users with a legitimate concern can get…
168
A new set of vulnerabilities affecting users of PGP and S/MIME
UPDATE: Enigmail and GPG Tools have been patched for EFAIL. For more up-to-date information, please see EFF's Surveillance Self-Defense guides.UPDATE (5/14/18): More information has been released. See EFF's more detailed explanation and analysis here.A group of European security researchers have...
169
Website Glitch Let Me Overstock My Coinbase
Coinbase and Overstock.com just fixed a serious glitch that allowed Overstock customers to buy any item at a tiny fraction of the listed price. Potentially more punishing, the flaw let anyone paying with bitcoin reap many times the authorized bitcoin refund amount on any canceled Overstock orders.
170
171
Remote Code Execution in Alpine Linux
tl;dr I found several bugs in apk, the default package manager for Alpine Linux. Alpine is a really lightweight distro that is very commonly used with Docker...
172
USB Reverse Engineering: Down the Rabbit Hole
Thanks for the featured writeup Hackaday! Make sure to check out the comments over there as well. Looks like Hackernoon picked it up as well, make sure to check in with the comments there too. It would be great if you could also head over to Hacker News, give an upvote, and join in the comments there. Let's get this…
173
Bloomberg’s ‘The Big Hack’
One way or the other, there is more to come on this story, and either Bloomberg’s or Apple’s and Amazon’s credibility is going to take a significant hit.
174
Yubico and Microsoft Introduce Passwordless Login
The Security Key by Yubico with FIDO2 enables passwordless login for Windows 10 devices and Microsoft Azure Active Directory.
175
Enforcing TLS protocol invariants by rolling versions every six weeks
Search IETF mail list archives
176
YubiKey 5 Series with New NFC and FIDO2 Passwordless Features
Learn more about what's happening within the tech and cybersecurity industry and the developments in our business and security keys within our Yubico Blog.
177
The Legitimisation of Have I Been Pwned
There's no way to sugar-coat this: Have I Been Pwned [https://haveibeenpwned.com/] (HIBP) only exists due to a whole bunch of highly illegal activity that has harmed many individuals and organisations alike. That harm extends all the way from those in data breaches feeling a sense of
178
Beyond Passwords: 2FA, U2F and Google Advanced Protection
Last week I wrote a couple of different pieces on passwords, firstly about why we're going to be stuck with them for a long time yet [https://www.troyhunt.com/heres-why-insert-thing-here-is-not-a-password-killer/] and then secondly, about how we all bear some
179
Google’s new Chat service shows contempt for Android users’ privacy
Google launches Chat - new messaging service for Android phones
180
Wi-Fi Alliance Introduces Wi-Fi Certified WPA3 Security
Next generation Wi-Fi® security for personal and enterprise networks