571
Project Jengo Redux: Cloudflare’s Prior Art Search Bounty Returns
On March 15th, 2021, Cloudflare was sued by a patent troll called Sable Networks. Today, we are launching our efforts to fight back.
572
0-Day Vulnerability on Log4j
Learn about the Log4j vulnerability and how you can combat it. Read this comprehensive guide to get actionable tips.
573
Fintech Giant Fiserv Used Unclaimed Domain
If you sell Web-based software for a living and ship code that references an unregistered domain name, you are asking for trouble. But when the same mistake is made by a Fortune 500 company, the results can range from costly to disastrous. Here’s the story of one such goof committed by Fiserv [ NASDAQ:FISV ], a $15…
574
Reproducible builds for Debian: a big step forward
This is the second article in the “reproducible builds” series. Previously: Improvements in testing and building: GitLab CI and reproducible builds. In the previous article, Improvements in testing and building: GitLab CI and reproducible builds, we discussed reproducible builds and our...
575
Infosec Core Competencies
An incomplete list of (technical) things just about anybody working in Information Security would benefit from knowing.
576
No, RSA Is Not Broken
I have been seeing this paper by cryptographer Peter Schnorr making the rounds: “Fast Factoring Integers by SVP Algorithms.” It describes a new factoring method, and its abstract ends with the provocative sentence: “This destroys the RSA cryptosystem.” It does not. At best, it’s an improvement in factoring—and I’m not…
577
What every IT person needs to know about OpenBSD Part 3: That packet filter
Useful and fun features related to the OpenBSD packet filter.
578
Scientific notation bug in MySQL left AWS WAF vulnerable to SQL injection
We provide around-the-clock threat detection and incident response, backed by expert consulting to keep your organization secure.
579
580
581
Netmask NPM package, used by 270k+ projects, vulnerable to octal input data
The following research outlines a vulnerability discovered in netmask npm package that is currently used by 278,722+ other projects. The vulnerability has been present for 9 years. Since this package is so incredibly widespread, I would suggest every nodejs developer to check their package.jsons to see if they use…
582
Microsoft Issues Emergency Patch for Windows Flaw
Microsoft on Tuesday issued an emergency software update to quash a security bug that’s been dubbed “ PrintNightmare ,” a critical vulnerability in all supported versions of Windows that is actively being exploited. The fix comes a week ahead of Microsoft’s normal monthly Patch Tuesday release, and follows the…
583
We found a phone with pre-installed malware via the Lifeline Assistance program
We discovered yet another phone model with pre-installed malware provided from the Lifeline Assistance program via Assurance Wireless by Virgin Mobile.
584
585
Automatic cipher suite ordering in Go’s crypto/tls
Go 1.17 is making TLS configuration easier and safer by automating TLS cipher suite preference ordering.
586
The censorship of WallStreetBets needs to be a watershed moment for everyone
This event is when censorship overstepped a very serious mark.
587
A wiper attack paralyzed the Iranian train system
In the midst of an epic troll on a country-wide railway system, we discovered a new threat actor and their reusable wiper called Meteor.
588
Cross-Account Container Takeover in Azure Container Instances
Affecting Azure Container Instances, Azurescape is the first known cross-account container takeover in the public cloud.
589
590
Wanted: Disgruntled Employees to Deploy Ransomware
Criminal hackers will try almost anything to get inside a profitable enterprise and secure a million-dollar payday from a ransomware infection. Apparently now that includes emailing employees directly and asking them to unleash the malware inside their employer’s network in exchange for a percentage of any ransom…
591
Clover Health: How Chamath Lured Retail Investors into a Broken Business
Initial Disclosure: This report represents our opinion, and we encourage every reader to do their own due diligence. Please see our full disclaimer at the bottom of the report. We have no position (short or long) in Clover Health because we think in this moment for public markets, it is more important for people to…
592
What I Wish I Knew About U2F and Other Hardware MFA Protocols
We revamped the second-factor authentication in Teleport 6.0. This post provides a birds-eye view of U2F and other cryptographic hardware standards.
593
594
595
Reading the AGPL
a guided introduction for first-timers
596
A reference counting bug which leads to local privilege escalation in io_uring
Hello, I’m Shiga( @Ga_ryo_ ), a security engineer at Flatt Security Inc.
597
HAProxy vulnerability enables HTTP request smuggling attacks
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
598
Linux Capabilities in a nutshell (2019)
Linux capabilities can be difficult to understand so let's go through them quickly
599
600
Analyzing and breaking an externally encrypted HDD
Analyzing and breaking external encrypted HDD has been a “hobby” of mine for quite some time. With my colleagues Joffrey Czarny and Julien Lenoir we looked at several models in the past :