151
152
153
Crouching T2, Hidden Danger
Let’s talk about that thing nobody’s talking about. Let’s talk about a vulnerability that’s exposing 2018-2020 Macs while most are declining to act nor report about the matter. Oh, and did I mention it’s unpatchable?
154
Secure by Design
I really like Secure by Design. The key idea is that there is a big overlap between secure code and good software design. Code that is strict, clear and focused will be easier to reason about, and …
155
Turn on MFA Before Crooks Do It for You
Hundreds of popular websites now offer some form of multi-factor authentication (MFA), which can help users safeguard access to accounts when their password is breached or stolen. But people who don’t take advantage of these added safeguards may find it far more difficult to regain access when their account gets…
156
Promiscuous cookies and their impending death via the SameSite policy
Cookies like to get around. They have no scruples about where they go save for some basic constraints relating to the origin from which they were set. I mean have a think about it: If a website sets a cookie then you click a link to another page on that
157
Popular iPhone and iPad Apps Snooping on the Pasteboard
This article provides an investigation of some popular apps that frequently access the pasteboard without user consent. These apps range from popular games and social networking apps, to news apps of major news organizations. We found that many apps quietly read any text found in the pasteboard every time the app is…
158
The Now-Defunct Firms Behind 8chan, QAnon
Some of the world’s largest Internet firms have taken steps to crack down on disinformation spread by QAnon conspiracy theorists and the hate-filled anonymous message board 8chan . But according to a California-based security researcher, those seeking to de-platform these communities may have overlooked a simple legal…
159
Does Your Domain Have a Registry Lock?
If you’re running a business online, few things can be as disruptive or destructive to your brand as someone stealing your company’s domain name and doing whatever they wish with it. Even so, most major Web site owners aren’t taking full advantage of the security tools available to protect their domains from being…
160
161
162
Anti-fingerprinting extensions tend to make fingerprinting easier
Browser extensions claiming to protect against fingerprinting will typically result in more data available for fingerprinting.
163
164
How does Brown University know where you are?
In September 2020, Brown University accused students of lying about their location; e.g.:
165
How I lost control of our bank accounts to a phone scammer
Yesterday, instead of having a productive afternoon at home, I had the privilege of sitting at the bank for a couple of hours, resolving a problem completely of my own doing: I fell for a phone scammer. My wife and I had to close our accounts—which were in excess of 25 years old—and set up new ones. I then spent hours…
166
Tracking users via CSS
I try to be a friendly citizen of the web. I try to keep my site in good shape. It should load quickly, track nothing beyond your basic server logs, not hassle you about cookies, GDPR or my newsletter. I do have a newsletter but it won't pop up in your face here. I try to stay firmly on the side of friendly and a good…
167
Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators
Why you should be opting for local tooling when working with sensitive data, even Non-Production ones.
168
169
Sendgrid under siege from hacked accounts
Email service provider Sendgrid is grappling with an unusually large number of customer accounts whose passwords have been cracked, sold to spammers, and abused for sending phishing and email malware attacks. Sendgrid’s parent company Twilio says it is working on a plan to require multi-factor authentication for all…
170
It’s 255:19AM. Do you know what your validation criteria are?
Ed25519 signature validation criteria vary widely between implementations, creating risks for consensus systems. Here's why and how to fix it.
171
172
173
Maersk, Me and NotPetya
Maersk is the world’s largest integrated shipping and container logistics company.
174
Backdoors and other vulnerabilities in HiSilicon based hardware video encoders
Serious vulnerabilities (including a backdoor) in IPTV/H.264/H.265 video encoders based on HiSilicon hi3520d hardware.
175
176
177
Blue Team Rust: What Is “Memory Safety”, Really?
A brief technical primer on Rust's key security feature, with embedded-specific context.
178
Does Zoom use end-to-end encryption?
TL;DR: It’s complicated. Yesterday Zoom (the videoconferencing company, not the defunct telecom) put out a clarification post describing their encryption practices. This is a nice example of …
179
Mac sandbox escape
This blog post discloses a sandbox escape on macOS. I reported the issue to Apple Product Security on December 19 2019, the day the Apple Security Bounty program finally opened. (I discovered the issue in August 2019.) Today I received an email from Apple Product Security saying "we do not see any actual security…
180
So you want to roll your own crypto?
A coworker of mine asked: How are people supposed to learn (from mistakes) if they don't roll their own crypto? The short answer is do roll ...