181
Vulnerability in Bumble dating app reveals any user's exact location
The vulnerability in this post is real. The story and characters are obviously not.
182
Is Microsoft Stealing People’s Bookmarks?
I received email from two people who told me that Microsoft Edge enabled synching without warning or consent, which means that Microsoft sucked up all of their bookmarks. Of course they can turn synching off, but it’s too late. Has this happened to anyone else, or was this user error of some sort? If this is real, can…
183
How to Tell a Job Offer from an ID Theft Trap
One of the oldest scams around — the fake job interview that seeks only to harvest your personal and financial data — is on the rise, the FBI warns. Here’s the story of a recent LinkedIn impersonation scam that led to more than 100 people getting duped, and one almost-victim who decided the job offer was…
184
Essential security for Linux servers (2013)
Father, Founder, and FuturistBuilding bestinterest.app and podcasting for coparents.Learn more about me.
185
Representing SHA-256 Hashes as Avatars
How to turn 256 bits of entropy into a beautiful, avatar-friendly circular SVG: the Hashvatar.
186
187
SolarWinds: What Hit Us Could Hit Others
New research into the malware that set the stage for the megabreach at IT vendor SolarWinds shows the perpetrators spent months inside the company’s software development labs honing their attack before inserting malicious code into updates that SolarWinds then shipped to thousands of customers. More worrisome, the…
188
I'm unsure of the security of simultaneous multithreading on modern x86 CPUs
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
189
Let's Encrypt's old root certificate is expiring
On 30th September 2021, the root certificate that Let's Encrypt are currently using, the IdentTrust DST Root CA X3 certificate, will expire. You may or may not need to do anything about this Root CA expiring, but I'm betting a few things will probably break on that day
190
191
Spectre exploits in the "wild"
Personal blog of Julien (jvoisin) Voisin
192
The Rise of One-Time Password Interception Bots
In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords (OTPs) that many websites require as a second authentication factor in addition to passwords. That service quickly went offline, but new research reveals a number of competitors have since…
193
VPN over SSH? The Socks Proxy
Some resources on the internet might be only accessible from clients with particular IP addresses. For example, suppose you want to…
194
Faking Twitter unfurling to phish you
Do you trust links? Well, you shouldn’t. Do you trust this link: Twitter says this link should take you to Uniswap, nobody would be none-the-wiser because we…
195
What data on myself I collect and why (2020)
How I am using 50+ sources of my personal data
196
No general method to detect fraud
The parts of a convincing deception
197
198
199
RSA chief believed cryptographers’ warnings on Dual EC DRBG lacked merit (2014)
"When, last September, it became possible that concerns raised in 2007 might have merit as part of a strategy of exploitation, NIST as the...
200
I exploited existing YouTube videos with a fake Patreon profile
I am watching a lot of investing videos on youtube recently. I like to watch them while I eat, or they play in the background while I do something else. I…
201
DDoS-Guard to forfeit internet space occupied by Parler
Parler , the beleaguered social network advertised as a “free speech” alternative to Facebook and Twitter, has had a tough month. Apple and Google removed the Parler app from their stores, and Amazon blocked the platform from using its hosting services. Parler has since found a home in DDoS-Guard , a Russian digital…
202
OAuth with Cloudflare workers on a statically generated site
An article on implementing OAuth user registration for a newsletter on a statically generated site using Cloudflare workers.
203
Using GDPR to obtain one’s data as JSON
TL;DR: If you live in the EU or are a EU citizen, companies must provide personal data you provided or they collected in a machine-readable format, following the article 20 of the GDPR.
204
REvil Ransom Arrest, $6M Seizure, and $10M Reward
The U.S. Department of Justice today announced the arrest of Ukrainian man accused of deploying ransomware on behalf of the REvil ransomware gang, a Russian-speaking cybercriminal collective that has extorted hundreds of millions from victim organizations. The DOJ also said it had seized $6.1 million in cryptocurrency…
205
The pitfalls of using SSH-agent, or how to use an agent safely
Unfortunately for you, we promised a follow up to talk about the security implications of using such an agent. So, here we are.
206
Incenser, or how NSA and GCHQ are tapping internet cables (2014)
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
207
SimpleVisor – Intel VT-x hypervisor in 500 lines of C code
Simplevisor : SimpleVisor is a simple, portable, Intel VT-x hypervisor with two specific goals: using the least amount of assembly code (10 lines), and having the smallest amount of VMX-related code to support dynamic hyperjacking and unhyperjacking (that is, virtualizing the host state from within the host). It runs…
208
No, I did not hack your MS Exchange server
New data suggests someone has compromised more than 21,000 Microsoft Exchange Server email systems worldwide and infected them with malware that invokes both KrebsOnSecurity and Yours Truly by name.
209
Amazon Assistant lets Amazon track your every move on the web
Amazon Assistant browser extension delegates its wide range of privileges to Amazon web services. The potential for misuse is enormous.
210
A few thoughts on Fuchsia security
I want to say a few words about my current adventure. I joined the Fuchsia project at its inception and worked on the daunting task of buil...