91
Log4j: Between a rock and a hard place
There is more than enough written on the mechanics of and mitigations for the recent severe RCE in log4j . On prevention, this is the most interesting widely-reshared insight I have seen:
92
DuckDuckGo Extension to Block FLoC, Google’s New Tracking Method in Chrome
Google has created a new tracking mechanism called FLoC, put it in Chrome, and automatically turned it on for millions of users. It's bad for privacy, which is why we're now blocking it in the DuckDuckGo extension.
93
I mailed an AirTag and tracked its progress
I sent an AirTag by mail to a friend and tracked it across the UK.
94
EFF Joins Global Coalition Asking Apple CEO Tim Cook to Stop Phone-Scanning
EFF has joined the Center for Democracy and Technology (CDT) and more than 90 other organizations to send a letter urging Apple CEO Tim Cook to stop the company’s plans to weaken privacy and security on Apple’s iPhones and other products. Have you signed the petition?
95
Six Palestinian organizations hacked with NSO Group’s Pegasus Spyware
On 19 October 2021, Israeli Minister of Defense, Benny Gantz, announced the designation of six leading Palestinian civil society organizations in the Occupied Palestinian Territory as “terrorist organizations” under Israel’s Anti-Terrorism Law 2016. The groups named are Addameer; Al-Haq; Defense for Children …
96
Grand jury subpoena for Signal user data, Central District of California
It’s the first half of 2021 – nearly five years since the “first half of 2016” – but in many ways not much has changed. The United Kingdom is still trying to figure out Brexit, another Justin Bieber song hit #1 on the charts (is it too late now to say sorry?), and Signal still doesn’t really know...
97
The ownership and future of Mullvad VPN
This article is by our founders and sole shareholders, Daniel Berntsson and Fredrik Strömberg. Mullvad VPN is here to stay, and we are not interested in ever selling it.
98
99
The database servers powering Let's Encrypt
Let’s Encrypt helps to protect a huge portion of the Web by providing TLS certificates to more than 235 million websites. A database is at the heart of how Let’s Encrypt manages certificate issuance. If this database isn’t performing well enough, it can cause API errors and timeouts for our subscribers. Database…
100
A Look at iMessage in iOS 14
Posted By Samuel Groß, Project Zero On December 20, Citizenlab published “The Great...
101
Web Scrapers Claim to Sell Personal Data on Facebook Users on a Hacker Forum
Data on over 1.5 billion Facebook users is being sold on a hacking-related forum, enabling cybercriminals advertisers to target users.
102
103
Zoom zero-day discovery
White hat hackers demonstrated a Zoom vulnerability allowing a Remote Code Execution attack at the Pwn2Own event.
104
Trump’s new social media platform found using Mastodon code
From media reports and individual findings that various people have presented to us, it seems that the new social media platform owned by the former president of the United States, Donald J. Trump, so-called Truth Social, is using Mastodon’s source code with various visual adjustments. The platform has not formally…
105
Use Touch ID for Sudo on Mac
The landscape of security is changing quite a bit. We've gone from basic username and password to 2FA, facial recognition, fingerprint recognition, and so
106
Surveilance bill rushed through Australian parliament in 24 hours
New Australian surveillance bill enables police to hack your device, collect or delete your data, and take over your social media accounts.
107
URL shorteners set ad tracking cookies
This Christmas, a family member sent me a URL to a family Zoom call. However, they didn’t send me a direct link to Zoom. Instead, they sent me a
108
Uncovering a 24-year-old bug in the Linux Kernel
How a failing rsync run led to the discovery of a long-standing bug in the Linux TCP implementation.
109
‘Trojan Source’ Bug Threatens the Security of All Code
Virtually all compilers — programs that transform human-readable source code into computer-executable machine code — are vulnerable to an insidious attack in which an adversary can introduce targeted vulnerabilities into any software without being detected, new research released today warns. The vulnerability…
110
Emulating AirTags to upload arbitrary data via Apple's FindMy network
Apple AirTags: Arbitrary data can be uploaded from non-internet-connected devices by sending Find My BLE broadcasts to nearby Apple devices. We're releasing an ESP32 firmware that turns the microcontroller into an (upload only) modem, and a macOS application to retrieve, decode and display the uploaded data.
111
Malicious PyPI packages stealing credit cards and injecting code
JFrog finds a new supply chain attack targeting python developers using the PyPI repository
112
113
CCPA Scam – Human subject research study conducted by Princeton University
Get ready for the CCPA compliance scams from Princeton.
114
115
116
Always-on Processor magic: How Find My works while iPhone is powered off
Wireless and firmware hacking, PhD life, Technology
117
Site Isolation in Firefox
With Site Isolation enabled on Firefox for Desktop, Mozilla takes its security guarantees to the next level.
118
A case against security nihilism
This week a group of global newspapers is running a series of articles detailing abuses of NSO Group’s Pegasus spyware. If you haven’t seen any of these articles, they’re worth re…
119
Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
Unveiling a scheme flooding vulnerability across major browsers. Learn how it threatens anonymous browsing.
120
Password Managers
I’ve spent a lot of time trying to understand the attack surface of popular password managers. I think I’ve spent more time analyzing them than practically anybody else, and I think that qualifies me to have an opinion!