241
Spoofing Google Search Results
By adding two parameters to any Google Search URL, you can replace search results with a Knowledge Graph card of your choice. A malicious user can use this to generate false information or ‘fake news’.
242
Zero-knowledge attestation
U2F/FIDO tokens (a.k.a. “Security Keys”) are a solid contender for doing something about the effectiveness of phishing and so I believe they're pretty important. I've written a fairly lengthy introduction to them previously and, as mentioned there, one concerning aspect of their design is that they permit attestation…
243
Let's Clarify Some Misunderstandings Around Sign in with Apple
tl;dr This is a good move for users in the iOS ecosystem, and is primarily designed as an alternative for apps that currently use "Sign in with [Facebook/Twitter/Google]" to avoid leaking sensitive user info. Yes, Apple is entering the ...
244
245
Ways to leak your data: apps’ circumvention of the Android permissions system
50 ways to leak your data: an exploration of apps’ circumvention of the Android permissions system Reardon et al., USENIX Security Symposium 2019 The problem is all inside your app, she said to me …
246
The Information Apocalypse (2018)
My friend Aviv was recently the subject of a popular Buzzfeed article about the possibility of an impending “information apocalypse”. tl;dr: Aviv extrapolates from the fake news crisis that started in 2016 to a world in which anyone can create AI-assisted misinformation campaigns indistinguishable from reality to the…
247
Ransomware gangs now outing victim businesses that don't pay
As if the scourge of ransomware wasn’t bad enough already: Several prominent purveyors of ransomware have signaled they plan to start publishing data stolen from victims who refuse to pay up. To make matters worse, one ransomware gang has now created a public Web site identifying recent victim companies that have…
248
BPF port-based firewall for systemd services
The first post introduced the IPIngressFilterPath and IPEgressFilterPath feature for the upcoming systemd release 243 to support custom BPF programs as firewall for services. There was a simple example for a minimal BPF program written in C and how to load it for a systemd service. Then there was a standalone program…
249
x86 API Hooking Demystified (2012)
Simak Live Draw SDY Tercepat Hari Ini, Hasil Live SDY, Live Result Sidney, Dan Rekap Togel SDY Lengkap Dan Akurat Hanya Di Sini.
250
Information Security Mental Models
Mental models frame how we think about the world. This article describes how they work and why we need more of them in information security.
251
iPhone Apps Surreptitiously Communicated with Unknown Servers
Long news article (alternate source) on iPhone privacy, specifically the enormous amount of data your apps are collecting without your knowledge. A lot of this happens in the middle of the night, when you’re probably not otherwise using your phone: IPhone apps I discovered tracking me by passing information to third…
252
253
254
Obfuscated JavaScript, scam emails, and American Express
Reverse-engineering an obfuscated American Express phishing campaign from email to exfiltration endpoint.
255
Hidden Cam Above Bluetooth Pump Skimmer
Tiny hidden spy cameras are a common sight at ATMs that have been tampered with by crooks who specialize in retrofitting the machines with card skimmers. But until this past week I’d never heard of hidden cameras being used at gas pumps in tandem with Bluetooth-based card skimming devices.
256
257
258
Modchips of the State
Collection of my projects and hacks.
259
A dive into the world of MS-DOS viruses
This post is a textual version of a talk I gave at The 35th Chaos Computer Congress at the end of 2018. You can watch the talk that was recorded by the wonderful C3VOC team below if that’s your preferred medium:
260
Cybersecurity Checklist for Political Campaigns
Short-lived political campaigns rarely build formal security programs and often assume they're too small to attract serious attackers, but campaigns across the United States have been targeted by document theft and credential phishing. Six observed attacker tactics map to a short list of defensive priorities, starting…
261
Keyringless GnuPG
My favorite music player is Audacious . It follows the Winamp Classic tradition of not trying to manage my music library. Instead it waits patiently for me to throw files and directories at it. These selections will be informally grouped into transient, disposable playlists of whatever I fancy that day.
262
263
On Covering Webcams
The problem isn’t your camera, it’s malware. Don’t install any software from unknown or sketchy sources, keep your OS up to date, and you should be fine. And if you do have malware on your Mac, the webcam is likely the least of your problems.