181
182
MacOS monitoring the open source way
Dash knows your context, your team, and your work, so your team can stay organized, easily find and share knowledge, and keep projects secure, all from one place.
183
A Developer’s Guide to Responding to National Security Letters
When the FBI Shows Up at Your Office with an NSL When you receive thousands of requests from law enforcement each year, it’s actually not a surprise wh
184
U.S. Secret Service Warns ID Thieves Are Abusing USPS’s Mail Scanning Service
A year ago, KrebsOnSecurity warned that “Informed Delivery,” a new offering from the U.S. Postal Service (USPS) that lets residents view scanned images of all incoming mail, was likely to be abused by identity thieves and other fraudsters unless the USPS beefed up security around the program and made it easier for…
185
Private Internet Access Goes Open Source
Private Internet Access is the world's best open-source VPN, with open-source VPN protocols, tons of advanced features, and apps for all devices.
186
TSA’s Roadmap for Airport Surveillance Moves in a Dangerous Direction
The Transportation Security Administration has set out an alarming vision of pervasive biometric surveillance at airports, which cuts against the right to privacy, the “right to travel,” and the right to anonymous association with others.The FAA Reauthorization Act of 2018, which included language...
187
Demystifying CORS
CORS (Cross-Origin Resource Sharing) is subject tinged with dread for many web developers. Like tales of a mythical sea beast, every developer has a story to tell about the day CORS seized upon one of their web requests, dragging it down into the inexorable depths, never to be seen again.
188
Spectre and the end of langsec
wingolog: article: spectre and the end of langsec
189
Intelligent Tracking Prevention 2.0
Note: Read about improvements to this technology in recent blog posts about Intelligent Tracking Prevention, and the Storage Access API.
190
MikroTik routers are forwarding owners’ traffic to unknown attackers
[Update] 2018-09-05 11:00 GMT+8, with the generous help from the AS64073, 103.193.137.211 has been promptly suspended and is no longer a threat. Overview MikroTik is a Latvian company founded in 1996 to develop routers and wireless ISP systems. MikroTik now provides hardware and software for
191
192
Blackbird's Patent Troll Suit Against Cloudflare Gets Patent Invalidated
As we have talked about repeatedly in this blog, we at Cloudflare are not fans of the behavior of patent trolls. They prey upon innovative companies using overly-broad patents in an attempt to bleed settlements out of their targets.
193
Does Australia's access and assistance law impact 1Password?
Australia recently passed a law that correctly has people asking about the security and privacy of tools like 1Password.
194
Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M
Hackers used phishing emails to break into a Virginia bank in two separate cyber intrusions over an eight-month period, making off with more than $2.4 million total. Now the financial institution is suing its insurance provider for refusing to fully cover the losses.
195
A Recycled IP Address Caused Me to Pirate Books by Accident
Let me tell you a story on how a subdomain of mine managed to serve 390,000+ PDF books without any of my servers being compromised.
196
Intel Security Issue Update: Addressing Reboot Issues
Intel Newsroom delivers the latest news, announcements, and updates. Stay informed on Intel innovations.
197
Responsibility Deflected, the CLOUD Act Passes
UPDATE, March 23, 2018: President Donald Trump signed the $1.3 trillion government spending bill—which includes the CLOUD Act—into law Friday morning. “People deserve the right to a better process.”Those are the words of Jim McGovern, representative for Massachusetts and member of the House of...
198
Into the Borg – SSRF inside Google production network
Intro - Testing Google Sites and Google Caja In March 2018, I reported an XSS in Google Caja, a tool to securely embed arbitrary html/javascript in a webpage. In May 2018, after the XSS was fixed, I r
199
Panera Bread did nothing about its customer data vulnerability for eight months
tl;dr: In August 2017, I reported a vulnerability to Panera Bread that allowed the full name, home address, email address, food/dietary…
200
7-Zip: Multiple Memory Corruptions via RAR and ZIP
Blog about anti-virus software vulnerabilities.
201
The FBI could have broken into San Bernadino shooter's phone without Apple
The Department of Justice’s Office of the Inspector General (OIG) last week released a new report that supports what EFF has long suspected: that the FBI’s legal fight with Apple in 2016 to create backdoor access to a San Bernardino shooter’s iPhone was more focused on creating legal precedent than...
202
203
Introducing DNS Resolver for Tor
As was mentioned in the original 1.1.1.1 blog post, our policy is to never write client IP addresses to disk and wipe all logs within 24 hours. Still some folks might not want to reveal their IP address to the resolver at all. This is why we are launching a Tor hidden service for our resolver.
204
205
Evaluation of five password managers
With an interactive grid to help you pick one!
206
‘Jackpotting’ Attacks Hit U.S. ATMs
ATM “ jackpotting ” — a sophisticated crime in which thieves install malicious software and/or hardware at ATMs that forces the machines to spit out huge volumes of cash on demand — has long been a threat for banks in Europe and Asia, yet these attacks somehow have eluded U.S. ATM operators. But all that changed this…
207
Google bug bounty for security exploit that influences search results
Short version: For the $12 cost of a domain, I was able to rank in Google search results against Amazon, Walmart etc. for high value money terms in the US. The…
208
Firefox’s Trusted Recursive Resolver DNS feature is dangerous
Affordable VM hosting in Glarus, Switzerland, operated by 100% hydropower. Devuan, debian, freebsd, ubuntu, centos. Our tech stack is fully open source.
209
OpenPGPjs has passed an independent security audit
We maintain the OpenPGPjs encryption library. After some recent code enhancements, OpenPGPjs underwent an independent security audit, the results of which are discussed in this article.
210
Qualcomm, National Security, and Patents
The Trump administration blocked Broadcom’s acquisition of Qualcomm, and I think it was the right move. Understanding why means understanding Qualcomm and Broadcom’s plan for the compan…