331
332
Increasing transparency through advertiser identity verification
Our goal is to ensure users understand who is advertising to them and why they are seeing specific ads.
333
Beer Drinkers Guide to SAML
Learn about SAML authentication and the mechanics behind some of the most common SAML use cases, all through the fictional BaaS (Beer-as-a-Service).
334
Best practices for managing and storing secrets like API keys and credentials
We have compiled a list of some of the best practices to prevent API key leakage and keep secrets and credentials safe. Secrets management doesn’t have a one-size-fits-all approach, so this list considers multiple perspectives so you can be informed in deciding to or not to implement strategies.
335
System Hardening in Android 11
Posted by Platform Hardening Team In Android 11 we continue to increase the security of the Android platform. We have moved to safer def...
336
Sendgrid under siege from hacked accounts
Email service provider Sendgrid is grappling with an unusually large number of customer accounts whose passwords have been cracked, sold to spammers, and abused for sending phishing and email malware attacks. Sendgrid’s parent company Twilio says it is working on a plan to require multi-factor authentication for all…
337
338
RCE on Telia Routers
Multiple vulnerabilities could allow running arbitrary code on an intranet server and gain root access on all the customers' routers
339
It’s 255:19AM. Do you know what your validation criteria are?
Ed25519 signature validation criteria vary widely between implementations, creating risks for consensus systems. Here's why and how to fix it.
340
341
Nazar: Analyzing malware that was uncovered in leaked NSA files
In mid-2017, The Shadow Brokers exposed NSA files in a leak known as "Lost In Translation".Recently, researcher uncovered "Nazar", a previously-unknown APT that was mentioned in the leak.We decided to dive into each and every one of the components and share our technical analysis. What we found out, is far from being…
342
343
344
Exploiting Wi-Fi Stack on Tesla Model S
In the past two years, Keen Security Lab did in-depth research on the security of Tesla Cars and presented our research results on Black Hat 2017 and Black Hat 2018. Our research involves many in-veh
345
346
347
348
Google Cloud’s Secrets Manager
Secret Manager is a new GCP product that securely and conveniently stores API keys, passwords, certificates, and other sensitive data.
349
Maersk, Me and NotPetya
Maersk is the world’s largest integrated shipping and container logistics company.
350
Backdoors and other vulnerabilities in HiSilicon based hardware video encoders
Serious vulnerabilities (including a backdoor) in IPTV/H.264/H.265 video encoders based on HiSilicon hi3520d hardware.
351
Website data leaks pose greater risks than most people realize
Students find website data leaks pose greater risks than most people realize
352
353
354
Blue Team Rust: What Is “Memory Safety”, Really?
A brief technical primer on Rust's key security feature, with embedded-specific context.
355
Does Zoom use end-to-end encryption?
TL;DR: It’s complicated. Yesterday Zoom (the videoconferencing company, not the defunct telecom) put out a clarification post describing their encryption practices. This is a nice example of …
356
Mastering systemd: Securing and sandboxing applications and services
This series of articles will explore some of my favorite Red Hat Enterprise Linux (RHEL) 8 capabilities that are enabled by systemd. Thus, this series assume...
357
The EARN IT Bill Is the Government’s Plan to Scan Every Message Online
Update 10/1/2020: The EARN IT bill has been amended since this blog post was published. We still oppose the bill.Imagine an Internet where the law required every message sent to be read by government-approved scanning software. Companies that handle such messages wouldn’t be allowed to securely...
358
359
Hardcoded secrets, unverified tokens, and other common JWT mistakes
An extensible developer-friendly application security platform that scans source code to surface true and actionable security issues with AI-assisted SAST, SCA, and Secrets Detection solutions.
360
Mac sandbox escape
This blog post discloses a sandbox escape on macOS. I reported the issue to Apple Product Security on December 19 2019, the day the Apple Security Bounty program finally opened. (I discovered the issue in August 2019.) Today I received an email from Apple Product Security saying "we do not see any actual security…