421
The Supreme Backdoor Factory
Recently I was playing with VirusTotal Intelligence and while testing some dynamic behavior queries I stumbled upon this strange PE binary (MD5: …
422
AWS Control Tower
Earlier this month I met with an enterprise-scale AWS customer. They told me that they are planning to go all-in on AWS, and want to benefit from all that we have learned about setting up and running AWS at scale. In addition to setting up a Cloud Center of Excellence, they want to set up […]
423
NextDNS Joins Firefox’s Trusted Recursive Resolver
NextDNS Joins Firefox’s Trusted Recursive Resolver Program Committing to Data Retention and Transparency Requirements that Respect User Privacy Firefox a
424
Making Containers More Isolated: An Overview of Sandboxed Container Technologies
Currently available container-based infrastructure has limitations because containers are not truly sandboxed and share the host OS kernel. The root of the problem is the weak separation between containers when the host OS creates a virtualized userland for each container. This blog covers four unique projects from…
425
Tethered Jailbreaks Are Back
Earlier today, a new iPhone Boot ROM exploit, checkm8 (or Apollo or Moonshine), was published on GitHub by axi0mX, affecting the iPhone 4S through the iPhone X. The vulnerability was patched in devices with A12 and A13 CPUs. As of this writing, the iPhone XS, XS Max, XR, 11, 11 Pro and 11 Pro Max […]
426
A Technical and Cultural Assessment of the Mueller Report PDF
What can we learn about the Mueller Report from the PDF file released by the Department of Justice (DoJ) on April 18, 2019?
427
Oak, a Free and Open Certificate Transparency Log
Update: Feb. 5 2020 The Let’s Encrypt CT logs are now included in approved log lists and are usable by all publicly-trusted certificate authorities. Today we are announcing a new Certificate Transparency log called Oak. The Oak log will be operated by Let’s Encrypt and all publicly trusted certificate authorities will…
428
429
CVE-2019-1347: When a mouse over a file is enough to crash your system
Advanced security testing platforms for hardware and software investigations. Collaborative tools, proven attack libraries, and expert services for security teams.
430
431
ELF files on Linux
An step-by-step introduction into ELF files. Learn the structure and format, to understand how binaries and libraries on Linux systems work.
432
Trinity: PSP Emulator Escape
Trinity is a fully chained exploit for the PS Vita™ consisting of six unique vulnerabilities. It is based on a decade of knowledge and research. The source code of Trinity can be found here.
433
Public DNS in Taiwan the Latest Victim of BGP Hijack
Guest Post: Traffic going through a public DNS in Taiwan was rerouted to an entity in Brazil for about three and a half minutes.
434
Decentralized DNS with the Handshake Naming System
Starting since version 1.30, the Mac, Linux, and Windows Private Internet Access (PIA) desktop clients have come with the ability to change the selected
435
Curryfinger – Find the Server Behind the CDN
CURRYFINGER quickly and effectively identifies the real hosts behind CDN networks like CloudFlare - and outperforms existing tools. Find out how to use it.
436
An Update on Plugin Security
Learn about Figma's response to the security vulnerabilities that were reported in a 3rd-party library that we use for plugin security
437
DNS-over-HTTPS Policy Requirements for Resolvers
Over the past few months, we’ve been experimenting with DNS-over-HTTPS (DoH), a protocol which uses encryption to protect DNS requests and responses, with the goal of deploying DoH by default ...
438
Ukrainian Billionaires Allegedly Laundered Money in the US
Ukraine’s largest bank is taking its battle with its former owners to US shores. In a civil lawsuit filed in the state court of Delaware, PrivatBank accuses Ihor Kolomoisky and Gennady Bogolyubov, the billionaires who owned the bank before it was nationalized three years ago, of large-scale money laundering in the…
439
Write Fuzzable Code
“An obvious way to deal with embedded interpreters — which someone must have thought of and tried, but I don’t have any pointers — would be to have an API for teaching the fuzzer how to see coverage of the language being interpreted.”
440
Google Chrome is ditching its XSS detection tool
The Sophos Blog
441
Should Failing Phish Tests Be a Fireable Offense?
Would your average Internet user be any more vigilant against phishing scams if he or she faced the real possibility of losing their job after falling for one too many of these emails? Recently, I met someone at a conference who said his employer had in fact terminated employees for such repeated infractions. As this…
442
What’s Next in Making Encrypted DNS-over-HTTPS the Default
More than 70,000 users have already chosen on their own to explicitly enable DoH in Firefox Release edition. We are close to releasing DoH in the USA, and we have a few updates to share.
443
Bad Binder: Android In-the-Wild Exploit
Posted by Maddie Stone, Project ZeroIntroductionOn October 3, 2019, we disclosed issue 1942 (CVE-...
444
445
Fearless Security: Memory Safety
Memory safety violations can cause programs to crash unexpectedly and can be exploited to alter intended behavior--languages can manage this multiple ways
446
Monzo: How our security team handle secrets
We recently designed a new system to manage secret information safely – from the keys that we use to sign your Mastercard transactions, to credentials for external services.
447
Get Ready for New SameSite=None; Secure Cookie Settings
UPDATE (10/28/2019): We've revised the 2nd and 3rd bullet points in the section "How to Prepare; Known Complexities" below. In May, Chrome ...
448
449
Dear Search Guard Users
We’ve filed a lawsuit against the makers of Search Guard. Here is what we know, the actions we’re taking, and potential impact to Search Guard users.
450
Security flaws caused by compiler optimizations
Learn how to optimize compilers for enterprise-wide automation, avoiding pitfalls with examples and solutions.