61
A case against security nihilism
This week a group of global newspapers is running a series of articles detailing abuses of NSO Group’s Pegasus spyware. If you haven’t seen any of these articles, they’re worth re…
62
Password Managers
I’ve spent a lot of time trying to understand the attack surface of popular password managers. I think I’ve spent more time analyzing them than practically anybody else, and I think that qualifies me to have an opinion!
63
Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting
On Wednesday, the St. Louis Post-Dispatch ran a story about how its staff discovered and reported a security vulnerability in a Missouri state education website that exposed the Social Security numbers of 100,000 elementary and secondary teachers. In a press conference this morning, Missouri Gov. Mike Parson (R) said…
64
The Most Dangerous Censorship
Invisible but present, and far from the eyes of the public
65
How I Found a Vulnerability to Hack iCloud Accounts and How Apple Reacted to It
This article is about how I found a vulnerability on Apple forgot password endpoint that allowed me to takeover an iCloud account. The vulnerability is completely patched by Apple security team and it no longer works. Apple Security Team rewarded me $18,000 USD as a part of their bounty program but I refused to…
66
Zero click vulnerability in Apple’s macOS Mail
Zero-Click Zip TL;DR
67
What’s interesting about the Florida water system hack is that we heard about it
Stories about computer security tend to go viral when they bridge the vast divide between geeks and luddites, and this week’s news about a hacker who tried to poison a Florida town’s water supply was understandably front-page material. But for security nerds who’ve been warning about this sort of thing for ages, the…
68
Amazon Echo Flex: Microphone mute button appears to be real and functional
Teardown and analysis of electronics. Integrated circuit design analysis.
69
Simulating the PIN cracking scene in Terminator 2
In the beginning of Terminator 2: Judgement Day, John Connor uses a laptop to crack the PIN of a stolen debit card.
70
71
Hoax email blast abused poor coding in FBI website
The Federal Bureau of Investigation (FBI) confirmed today that its fbi.gov domain name and Internet address were used to blast out thousands of fake emails about a cybercrime investigation. According to an interview with the person who claimed responsibility for the hoax, the spam messages were sent by abusing…
72
Running a fake power plant on the internet for a month
There is a lot more on the internet than just social media and banking websites…
73
Update: YouTube-dl reinstated thanks to EFF (2020)
In October, the popular and famous archivist tool youtube-dl was taken down by GitHub due to a DMCA request by the Recording Industry Association of America. I posted a detailed analysis explaining the relation between international, US, EU and German law, and showing why this request was very different from what most…
74
Why I Wrote PGP (1999)
"Whatever you do will be insignificant, but it is very important that you do it." -Mahatma Gandhi
75
Tor is a great sysadmin tool (2020)
Using Tor to aid various system administration tasks, including checking firewall rules, bypassing internal network restrictions and connecting to remote systems that are behind NAT/CGNAT.
76
MarkMonitor left 60k domains for the taking
Thanks to Nagli and d0xing for helping figure out what was happening with this issue.
77
Signal Adds Cryptocurrency Support
According to Wired, Signal is adding support for the cryptocurrency MobileCoin, “a form of digital cash designed to work efficiently on mobile devices while protecting users’ privacy and even their anonymity.” Moxie Marlinspike, the creator of Signal and CEO of the nonprofit that runs it, describes the new payments…
78
79
Spectre mitigations murder userspace performance
Robert O'Callahan. Christian. Kiwi. Software guy. All content human-authored unless otherwise noted.
80
iPhone apps can tell many things about you through the accelerometer
Nearly every modern smartphone is equipped with an accelerometer, which, as the name implies, is a sensor that measures acceleration. It’s most commonly used for detecting the device’s orientation. It also has many other uses, whether as a game controller in racing games, as a pedometer for counting daily steps, or to…
81
Another 0-day looms for many Western Digital users
Countless Western Digital customers saw their MyBook Live network storage drives remotely wiped in the past month thanks to a bug in a product line the company stopped supporting in 2015, as well as a previously unknown zero-day flaw. But there is a similarly serious zero-day flaw present in a much broader range of…
82
Little League wants all your information
To sign kids up for our city’s Little League baseball …
83
How to prevent email spoofing, using an unholy combination of silly standards
How to use SPF, DKIM, and DMARC to improve your domain's email security and limit spoofing - but written for humans.
84
85
My NAS exposes itself over the internet without permission
The Terramaster NAS decided to expose itself to the public internet without asking. Let's see what we can do about it.
86
Sealed U.S. Court Records Exposed in SolarWinds Breach
The ongoing breach affecting thousands of organizations that relied on backdoored products by network software firm SolarWinds may have jeopardized the privacy of countless sealed court documents on file with the U.S. federal court system, according to a memo released Wednesday by the Administrative Office (AO) of the…
87
88
How to win at CORS
The 'how' and 'why' of CORS, from start to finish.
89
Ubiquiti developer charged with extortion, causing 2020 “breach”
Last year, I posted a series of articles about a purported “breach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press.
90
Remote code execution in Homebrew by compromising the official Cask repository
この記事は日本語でも投稿されています: https://blog.ryotak.net/post/homebrew-security-incident/ (もし日本語が読める場合、筆者は英語がそこまで得意ではないため、日本語の記事を読むことをお勧めします。) (Official blog post about this incident is available here: https://brew.sh/2021/04/21/security-incident-disclosure/) Preface Homebrew project is running a “Vulnerability Disclosure Program”…