241
Grindr to be fined almost €10M over GDPR complaint
The Norwegian Data Protection Authority confirmed that Grindr did not receive valid consent from users and announces a fine of 100 Mio NOK (€ 9.63 Mio) on Grindr.
242
243
Victory at the High Court against the government’s use of 'general warrants’
Today, the UK High Court has quashed a decision by the Investigatory Powers Tribunal (IPT), and ruled that section 5 of the Intelligence Services Act (ISA) 1994 does not permit the issuing of general warrants to authorise property interference and certain forms of computer hacking.
244
Fastmail accounts blocked in Russia, here's what we know
Fastmail is the latest email provider to be blocked by Russia.
245
"Secret" Agent Exposes Azure Customers to Unauthorized Code Execution
Wiz Research recently discovered a series of alarming vulnerabilities that highlight the supply chain risk of open source code, particularly for customers of cloud computing services.
246
247
How to boost your popularity on OkCupid using CSRF and a JSON type confusion
This is a quick blog post about a security vulnerability (now fixed) that allowed me to make anyone like or message a profile on okcupid.com simply by getting them to click a link on my website. In doing so, I used one of the most boring web application security issues (CSRF) combined with a somewhat interesting JSON…
248
How I hijacked the top-level domain of a sovereign state
Here’s how I temporarily took over 50% of all DNS traffic for the TLD of the Democratic Republic of Congo.
249
The Modern Guide to OAuth
Learn how OAuth 2.0 works with this simplified explanation and guide. Learn what it is, why it's essential for secure authorization, and best practices for implementation.
250
EBCDIC is incompatible with GDPR
Welcome to acronym city! The Court of Appeal of Brussels has made an interesting ruling. A customer complained that their bank was spelling the customer's name incorrectly. The bank didn't have support for diacritical marks. Things like á, è, ô, ü, ç etc. Those accents are common in many languages. So it was a little…
251
Bahraini Government Hacks Activists with NSO Group Zero-Click iPhone Exploits
We identified nine Bahraini activists whose iPhones were successfully hacked with NSO Group’s Pegasus spyware between June 2020 and February 2021. The hacked activists included three members of Waad (a secular Bahraini political society), three members of the Bahrain Center for Human Rights, two exiled Bahraini…
252
Malwarebytes' privacy VPN is Mullvad in a shady trenchcoat
Personal blog of Julien (jvoisin) Voisin
253
Private censorship is not the best way to fight hate or defend democracy (2018)
From Cloudflare’s headline-making takedown of the Daily Stormer last autumn to YouTube’s summer restrictions on LGBTQ content, there's been a surge in “voluntary” platform censorship. Companies—under pressure from lawmakers, shareholders, and the public alike—have ramped up restrictions on speech,...
254
How often should I rotate my SSH keys?
Learn why rotating your SSH keys is essential for preventing credential theft. Discover best practices for SSH key rotation and how to protect your systems from potential breaches.
255
Writing a firmware-only keylogger
In the previous blog post, I looked at the EC firmware in my laptop. This time I will look into the WiFi firmware of the same laptop.
256
Mimicking a device is becoming almost impossible
From User-Agent tricks to canvas hashes, see how modern device detection—Picasso, fonts, emojis, touch—makes spoofing fail. Learn how to blend in safely.
257
CVE Stuffing
I monitor the @CVENew Twitter feed to keep up with any interesting new vulnerabilities that are released. On December 11th CVE-2020-29589 was published claiming that “the kapacitor Docker ima…
258
Privacy Analysis of FLoC
In a previous post, I wrote about a new set of technologies “Privacy Preserving Advertising”, which are intended to allow for advertising without compr
259
Did Schnorr destroy RSA? Show me the factors
Schnorr has claimed new factoring methods that “destroy RSA”. This should be easy to demonstrate with well known challenges.
260
I Hacked Google App Engine: Anatomy of a Java Bytecode Exploit
Back in college, I was very interested in Java bytecode. When I got an internship at Google in 2013, I was skeptical of the security of the Java version of Google App Engine and got permission to spend the last week of my internship doing a mini red team exercise, trying to break into App Engine. This is the story of…
261
Beg Bounties
When someone passed me hundreds of thousands of records on kids taken from CloudPets a few years ago [https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/] , I had a nightmare of a time getting in touch with the company. They'd
262
How we protect our most sensitive secrets from the most determined attackers
As a bank, we have a lot of secrets we need to protect to keep our customers and ourselves safe. These include private keys that only we know, which we use to digitally sign requests as coming from us (sort of like a private password). These private keys are super important and are used all over Monzo and when…
263
SHA-1 'fully and practically broken' by new collision (2020)
Independent security journalism: news and analysis on intrusions, vulnerabilities, AI, policy and the software supply chain, plus video and podcasts.
264
An unwanted update to your Google Account
Google sent me an email informing me that they will change the country associated with my account in 30 days. I wanted to know why.
265
Dumping and extracting the SpaceX Starlink user terminal firmware
COSIC - Dumping and extracting the SpaceX Starlink User Terminal firmware ( )
266
Tor Browser 11.0
Tor Browser 11.0 is now available from the Tor Browser download page and our distribution directory. This is the first stable release based on Firefox ESR 91, and includes an important update to Tor 0.4.6.8.
267
The ‘Zelle fraud’ scam: how it works, how to fight back
One of the more common ways cybercriminals cash out access to bank accounts involves draining the victim’s funds via Zelle , a “peer-to-peer” (P2P) payment service used by many financial institutions that allows customers to quickly send cash to friends and family. Naturally, a great deal of phishing schemes that…
268
Getting Started with Signal
How to take advantage of Signal for secure messages and calls
269
270
Hacking YouTube with a MP4
Keyboard Warrior, Breaking software is just finding unintended features, right?