481
482
Segment Security Incident
Segment's Incident and Scheduled Maintenance History
483
Reverse engineering GoDaddy's tracking script
An article by Igor Kromin has provided an insight into a practice by GoDaddy involving injecting Javascript into customer sites. Several people expressed interest in a breakdown of the script - so here it is. Please review Igor’s original blog for further background
484
Public hacker test on Swiss Post’s e-voting system
Die Post unterstützt mit ihren Dienstleistungen den Alltag der Menschen in der Schweiz, in der physischen und in der virtuellen Welt. Beim E-Voting digitalisiert sie, was sie bereits am besten kann: den sicheren Transport vertraulicher Informationen.
485
OS X/Linker: New Mac malware attempts zero-day Gatekeeper bypass
Last week, Intego researchers discovered new Mac malware, OSX/Linker, that attempts to leverage a recently disclosed zero-day flaw in macOS' Gatekeeper protection. Let's examine what we know about this latest Mac malware campaign. What is the back story? Before digging into the OSX/Linker malware, it would be helpful…
486
487
Stuxnet was embarrassing, not amazing (2011)
As the New York Times posts yet another breathless story about Stuxnet, I’m surprised that no one has pointed out its obvious deficiencies. Everyone seems to be hyperventilating about its pur…
488
Improving privacy and security on the web
In 2008, we launched Chrome with the goal of building a speedy, simple, secure and stable web for everyone, everywhere. Ten years later, use...
489
Microsoft is Abandoning SHA-1 Hashes for Updates
Microsoft is shipping a patch to eliminate SHA-1 hashes from its update process. There’s nothing wrong with eliminating SHA-1—but their reasoning may be very interesting.
490
Wireless attacks on aircraft instrument landing systems
Wireless attacks on aircraft instrument landing systems Sathaye et al., USENIX Security Symposium 2019 It’s been a while since we last looked at security attacks against connected real-world entiti…
491
We Can Choose an Internet Without Surveillance
The internet is not just a network of computers—it’s a network of people. We hold great power in deciding its future.
492
Behind the One-Way Mirror: A Dive into the Technology of Corporate Surveillance
It's time to shed light on the technical methods and business practices behind third-party tracking. For journalists, policy makers, and concerned consumers, this paper will demystify the fundamentals of third-party tracking, explain the scope of the problem, and suggest ways for users and legislation to fight back…
493
Facebook’s Privacy Cake
Mark Zuckerberg’s announcement of A Privacy-Focused Vision for Social Networking is not some dramatic pivot: it is a growth opportunity for Facebook and a challenge for regulators.
494
495
496
497
Investigating the 900GB “Collection #1-5” password leaks with R
This post shows how to process gigabytes of unstructured data with the Spark framework and using the R language.
498
How to write a rootkit without really trying
We open-sourced a fault injection tool, KRF, that uses kernel-space syscall interception. You can use it today to find faulty assumptions (and resultant bugs) in your programs. Check it out! This post covers intercepting system calls from within the Linux kernel, via a plain old kernel module. We’ll go through a quick…
499
Google Calendar Event Injection with MailSniper (2017)
Beau Bullock & Michael Felch // Source: https://chrome.google.com/webstore/detail/google-calendar-by-google/gmbgaklkmjakoegficnlkhebmhkjfich Overview Google Calendar is one of the many features provided to those who sign up for a Google account along with other popular […]
500
Characterizing secret leakage in public GitHub repositories
How bad can it git? Characterizing secret leakage in public GitHub repositories Meli et al., NDSS’19 On the one hand you might say there’s no new news here. We know that developers shouldn’t …
501
Software Security Is a Programming Languages Issue (2018)
Software security must be addressed by all programmers, not just security experts. So we teach it in CS 330, a programming (languages) class.
502
Blockchain and Trust
In his 2008 white paper that first proposed bitcoin, the anonymous Satoshi Nakamoto concluded with: “We have proposed a system for electronic transactions without relying on trust.” He was referring to blockchain, the system behind bitcoin cryptocurrency. The circumvention of trust is a great promise, but it’s just…
503
Breaking Out of Docker via RunC
Unit 42 brings together world-renowned threat researchers, incident responders and security consultants to create an intelligence-driven, response-ready organization that's passionate about helping you proactively manage cyber risk.
504
AWS VPC Traffic Mirroring
Running a complex network is not an easy job. In addition to simply keeping it up and running, you need to keep an ever-watchful eye out for unusual traffic patterns or content that could signify a network intrusion, a compromised instance, or some other anomaly. VPC Traffic Mirroring Today we are launching VPC…
505
506
Firefox Local Files Theft – Not Patched Yet
Recently, I was performing a research on Same Origin Policy attacks, I managed to realize that the la version of Firefox (currently 67) is vulnerable to local files theft attack (on any supported OS), due to improper implementation of Same Origin Policy for file scheme URIs. Let’s go over the PoC details then I will…
507
Stealing sensitive browser data with the W3C Ambient Light Sensor API (2017)
In this post we describe and demonstrate a neat trick to exfiltrate sensitive information from your browser using a surprising tool: your smartphone or laptop’s ambient light sensor. In short: 1. We provide background about the light sensor API and current discussions to expose it more broadly to websites.
508
The Definitive Guide on Win32 to NT Path Conversion (2016)
Posted by James Forshaw, path’ological reverse engineer.How the Win32 APIs process file pat...
509
510