151
152
Another 0-day looms for many Western Digital users
Countless Western Digital customers saw their MyBook Live network storage drives remotely wiped in the past month thanks to a bug in a product line the company stopped supporting in 2015, as well as a previously unknown zero-day flaw. But there is a similarly serious zero-day flaw present in a much broader range of…
153
154
FIDO2 security key company releases hardware that's open source and uses Rust
Our Kickstarter campaign for our next generation of Solo products launches on January 26th. To get alerted when the campaign is live, you can sign up here. Update: The campaign is now live! Check it out to see all the details. Humble beginnings I've been working on Solo for almost 3 years now. It started back when I…
155
Little League wants all your information
To sign kids up for our city’s Little League baseball …
156
The SaaS CTO Security Checklist Redux
Learn how to protect your SaaS applications with the SaaS CTO security checklist. Doing the basics goes a long way in keeping your company and product secure.
157
HTTP/2-exclusive threats caused by implementation flaws and RFC imperfections
In this research paper James Kettle introduces multiple new classes of HTTP/2-exclusive attacks, demonstrated on popular websites and servers.
158
1Password for Linux
The wait is over. [1Password for Linux is officially here](https://support.1password.com/getting-started-linux/).
159
How to prevent email spoofing, using an unholy combination of silly standards
How to use SPF, DKIM, and DMARC to improve your domain's email security and limit spoofing - but written for humans.
160
WebAssembly and Back Again: Fine-Grained Sandboxing in Firefox 95
In Firefox 95, we're shipping a sandboxing technology called RLBox — developed with researchers at UC San Diego and the University of Texas
161
162
My NAS exposes itself over the internet without permission
The Terramaster NAS decided to expose itself to the public internet without asking. Let's see what we can do about it.
163
Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites (2019)
Dark patterns are user interface design choices that benefit an online service by coercing, steering, or deceiving users into making unintended and potentially harmful decisions. We conducted a large-scale study, analyzing ~53K product pages from ~11K shopping websites to characterize and quantify the prevalence of…
164
Sealed U.S. Court Records Exposed in SolarWinds Breach
The ongoing breach affecting thousands of organizations that relied on backdoored products by network software firm SolarWinds may have jeopardized the privacy of countless sealed court documents on file with the U.S. federal court system, according to a memo released Wednesday by the Administrative Office (AO) of the…
165
166
How to win at CORS
The 'how' and 'why' of CORS, from start to finish.
167
Firefox 87 introduces SmartBlock for Private Browsing
Today, with the launch of Firefox 87, we are excited to introduce SmartBlock, a new intelligent tracker blocking mechanism for Firefox Private Browsing and Strict Mode. SmartBlock ensures that strong ...
168
Ubiquiti developer charged with extortion, causing 2020 “breach”
Last year, I posted a series of articles about a purported “breach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press.
169
API Tokens: A Tedious Survey
Documentation and guides from the team at Fly.io.
170
Remote code execution in Homebrew by compromising the official Cask repository
この記事は日本語でも投稿されています: https://blog.ryotak.net/post/homebrew-security-incident/ (もし日本語が読める場合、筆者は英語がそこまで得意ではないため、日本語の記事を読むことをお勧めします。) (Official blog post about this incident is available here: https://brew.sh/2021/04/21/security-incident-disclosure/) Preface Homebrew project is running a “Vulnerability Disclosure Program”…
171
172
Mitigating Memory Safety Issues in Open Source Software
Posted by Dan Lorenc, Infrastructure Security Team Memory-safety vulnerabilities have dominated the security field for years and often lead ...
173
An opinionated guide on how to reverse engineer software
This is an opinionated guide. After 12 years of reverse engineering professionally, I have developed strong beliefs on how to get good at RE.
174
1Password Secrets Automation
Secure, orchestrate, and manage your company’s infrastructure secrets with 1Password Secrets Automation.
175
The internet is held together with spit and baling wire
A visualization of the Internet made using network routing data. Image: Barrett Lyon, opte.org.
176
The Python Package Index is now a GitHub secret scanning integrator
GitHub and the Python Package Index (PyPI) are collaborating to help protect you from leaked PyPI API tokens. From today, GitHub will scan every commit to a public repository for…
177
Testing Phone-Sized Faraday Bags
Complex software is, to put it mildly, hard to get right (for details, see almost any other posting on this or any other security blog). Especially for gadgets that are rich with microphones, cameras, location and environmental sensors, and communication links (such as, you know, smartphones), errors and security…
178
I have a lot to say about Signal’s Cellebrite hack
This blog post is based off of a talk I gave on May 12, 2021 at the Stanford Computer Science Department’s weekly lunch talk series on computer security topics. Full disclosure: I’ve done some consulting work for Signal, albeit not on anything like this issue. (I kinda doubt
179
The Microsoft MFA system almost brought me to a nervous breakdown
Update 12/10/21, 10:15 UTC: I never imagined this post would reach the front page on Hacker News and gather so much support. Thank you all…
180
