151
Critical Security Issue Identified in iTerm2
A security audit funded by Mozilla has discovered a critical security vulnerability in the widely used macOS terminal emulator iTerm2.
152
Reverse engineering a custom CPU from a single program
or: reverse-engineering a custom, unknown CPU from a single programtl;dr: We reverse-engineered a program written for a completely custom, unknown CPU architecture, without any documentation for th…
153
154
Audio Fingerprinting using the AudioContext API
Audio fingerprinting takes advantage of device performance specs to build up an identifying fingerprint of a user. It uses the AudioContext API for this
155
156
Weaponizing and Gamifying AI for WiFi Hacking: Presenting Pwnagotchi 1.0.0
This is the story of a summer project that started out of boredom and that evolved into something incredibly fun and unique. It is also the story of how that p…
157
An Overview of Cryptography
Free, evolving crypto tutorial since 1999!
158
Attorney General Barr and Encryption
Last month, Attorney General William Barr gave a major speech on encryption policy—what is commonly known as “going dark.” Speaking at Fordham University in New York, he admitted that adding backdoors decreases security but that it is worth it. Some hold this view dogmatically, claiming that it is technologically…
159
Technology Preview: Signal Private Group System
Groups are inherently social, and Signal is a social app. Whether you’re planning a surprise party, discussing last night’s book club meeting, exchanging photos with your family, or organizing something important, group messaging has always been a key feature of Signal. Signal provides private gr...
160
Infectious Executable Stacks
In software development there are many concepts that at first glance seem useful and sound, but, after considering the consequences of their implementation and use, are actually horrifying. Examples include thread cancellation , variable length arrays , and memory aliasing . GCC’s closure extension to C is another…
161
Modern C++ Won't Save Us
I’m a frequent critic of memory unsafe languages, principally C and C++, and how they induce an exceptional number of security vulnerabilities. My conclusion, based on reviewing evidence from numerous large software projects using C and C++, is that we need to be migrating our industry to memory safe by default…
162
Chrome 0-day exploit used in Operation WizardOpium
Recently, we caught a new unknown exploit for Chrome browser. After reviewing of the PoC we provided, Google confirmed there was a zero-day vulnerability and assigned it CVE-2019-13720.
163
How Apps on Android Share Data with Facebook (2018)
Facebook routinely tracks users, non-users and logged-out users outside its platform through Facebook Business Tools. App developers share data with Facebook through the Facebook Software Development Kit (SDK), a set of software development tools that help developers build apps for a specific operating system. Using…
164
I scanned Austria
Personal Blog of Christian Haschek
165
The 773M Record “Collection #1” Data Breach
Many people will land on this page after learning that their email address has appeared in a data breach I've called "Collection #1". Most of them won't have a tech background or be familiar with the concept of credential stuffing so I'm going to write this post
166
WordPress theme provider Pipdig using customer sites to DDoS competitors
pipdig, WordPress theme and plugin provider, caught distributing malicious code to customers and DDoSing competitors…
167
ICANN Calls for DNSSEC for All Domains Following Domain Hijacking Attempts
Announcement that the Internet Corporation for Assigned Names and Numbers (ICANN) believes there is an ongoing and significant risk to key parts of the Domain Name System (DNS) infrastructure and is calling for the full deployment of the Domain Name System Security Extensions (DNSSEC) across all unsecured domain names.
168
169
170
Report on Microsoft Office and Windows software: still privacy risks remaining
On behalf of the Dutch Ministry of Justice and Security, Privacy Company has investigated the privacy risks related to the use of Microsoft Windows 10 Enterprise, Office 365 ProPlus and Office Online, as well as the mobile Office apps. With the Ministry’s permission, we are publishing two blog posts about our…
171
Modern Alternatives to PGP
Did your last Yubikey just break? Perhaps you forgot an offline backup password. Maybe you’re just tired of living like a spy and never using smartphones. Whatever it is, you’re here, and you’re finally ready to give up on PGP. That’s great! We’re here to help! No one was sending you encrypted emails anyway, so that’s…
172
CSRF is really dead
A little while back I wrote a blog post about how "CSRF is dead". It focused on SameSite cookies, a powerful yet simple feature to protect your website against CSRF attacks. As powerful as it was, and as much as it will kill CSRF, you had to enable it on
173
Senate Testimony on Privacy Rights and Data Collection in a Digital Economy
Idle Words > Talks > Privacy Rights and Data Collection in a Digital Economy (Senate hearing)
174
EFF’s Tweet About a DMCA Takedown Is Now Subject to an Overzealous Takedown
Get ready for a tale as good as anything you’d see on television. Here’s the sequence of events: the website TorrentFreak publishes an article about a leak of TV episodes, including shows from the network Starz. TorrentFreak tweets its article, Starz sends a copyright takedown notice. TorrentFreak writes about the…
175
The State of Software Security in 2019
My goal in this post is to skim my observations on the state of software design and development over the past year, and to try to find a meaningful way forward for myself for 2019. My perspective is limited by the fact that I have worked exclusively in client-side software security for the past 7.5 years. Still, I…
176
Reversing Safeway's private APIs to automate coupon collection
Reverse-engineering Safeway's coupon APIs to automate adding digital offers to an account.
177
178
179
Mozilla and Opera remove Avast extensions from their add-on stores
The Avast extensions which were spying on their users are no longer available from Mozilla and Opera add-on stores. Google still has to take action.
180