301
We can't check the app permissions on Google Play anymore
Yep, Google removed the permissions list from Play Store, and we can no longer check the app permissions on it.
302
Taking action against scraping for hire
An update on what we're doing to protect people from scraping data on Facebook and Instagram.
303
Public CDNs Are Useless and Dangerous
Once upon a time, loading common scripts & styles from a public CDN like cdnjs or Google's Hosted Libraries was a 'best practice' - a great way to instantly...
304
CORS is not meant to secure an API endpoint
CORS does not secure your API: why browser-side API keys are unsafe, and how to protect Drupal JSON:API endpoints with proper authentication.
305
Reverse engineering Xiaomi air purifier NFC stickers
For a very thorough write-up on how this all works , please visit : https://unethical.info/2024/01/24/hacking-my-air-purifier/
306
Why CVE-2022-3602 was not detected by fuzz testing
So recently a very hyped memory corruption security vulnerability was discovered in the OpenSSL punycode parser. Some folks including Hanno ...
307
We found critical vulnerabilities in Hive Social
Dieser Artikel ist auch auf deutsch erschienen. Update: The vulnerabilities are currently no longer exploitable because Hive deactivated their servers. More details Following the Twitter takeover, a number of services promising to be an alternative gained traction. One of those is “Hive Social”, which reached more…
308
309
How to request removal of your contact info from Google search results
A new tool in Google Search can help you easily control whether your personally-identifiable information can be found in Search results.
310
What’s going on with security at PayPal?
PayPal's one-time login codes are a security disaster. Your account is at severe risk; remove your data or close your account immediately.
311
Critical cross-account vulnerability in Microsoft Azure automation service
AutoWarp is a critical vulnerability in Microsoft Azure Automation Service that allows unauthorized access to other customer accounts using the service.
312
313
Class Action Targets Experian over Account Security
A class action lawsuit has been filed against big-three consumer credit bureau Experian over reports that the company did little to prevent identity thieves from hijacking consumer accounts. The legal filing cites liberally from an investigation KrebsOnSecurity published in July, which found that identity thieves were…
314
Elliptic Curve Cryptography: A Basic Introduction
Elliptic Curve Cryptography (ECC) is a modern public-key encryption technique famous for being smaller, faster, and more efficient than incumbents. Bitcoin, for example, uses ECC as its asymmetric cryptosystem because it is so lightweight. The mathematical entity that makes all of this possible is the elliptic curve…
315
New Pegasus spyware abuses identified in Mexico
Mexican digital rights organization R3D, with technical support from the Citizen Lab, has determined that Mexican journalists and a human rights defender were infected with Pegasus between 2019 and 2021. The infections occurred years after the first revelations of Pegasus abuses in Mexico, and after Mexico’s current…
316
Apple, Google, and Microsoft commit to expanded support for FIDO standard
Faster, easier, and more secure sign-ins will be available to consumers across leading devices and platforms.
317
Running a private mail server for six years, easy peasy
Motivation The Right Reasons Tech Stack Implementation Mail rate and Spaminess Ongoing Maintenance Alternatives Conclusion
318
Towards a More Open Secure Element Chip
“ Secure Element ” (SE) chips have traditionally taken a very closed-source, NDA-heavy approach. Thus, it piqued my interest when an early-stage SE chip startup, Cramium (still in stealth mode), approached me to advise on open source strategy. This blog post explains my reasoning for agreeing to advise Cramium, and…
319
Planning Go 1.20 cryptography work
My plans for Go 1.20 include landing the crypto/ecdh package, making progress on moving math/big out of the security perimeter, and a batch of crypto/tls work.
320
Who's Attacking My Server?
One of the unexpected 1 outcomes of the Russian invasion in Ukraine is a large increase in nefarious access attempts to servers under my control, not necessarily appearing to arise from Russian IP addresses. There are the usual attempts at brute-forcing SSH access, for instance, but also a flurry of malevolent HTTP(S)…
321
322
A New Future for GnuPG
It has been quite some time since my last status report on GnuPG. I have been quite busy working on the project but unfortunately rarely active on the usual channels. So, here is a new report telling what we did over the last two or three years. Please read at least the last section.
323
Attacking Firecracker: AWS' MicroVM Monitor Written in Rust
Why are more security teams adopting Firecracker? How secure is it, and how suitable is it for your organization? This guide dives into this trending innovation.
324
325
Linux Certificate Authority root stores have a too simple view of 'trust'
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
326
Typical implementations of payment processing and related security issues
Thanks to @yarbabin for the logo Electronic payment systems have existed on the Internet for a long time, and some bugs in them are twenty years old. We’ve found critical vulnerabilities allowing us…
327
Hacking the PS4 / PS5 Through the PS2 Emulator
In this article I will discuss how I successfully escaped the PS2 emulator developed for the PlayStation 4. See also Part 2 , covering the next part of the exploit chain, and PlayStation's response to the research.
328
Don't Use RAR
Group for Apps and Services on Exascale Research Infrastructure is a research, development, and teaching unit at FIDIT + MedRi.
329
Want to start hacking?
We asked one of our top 10 hacker contributors, Johan Carlsson, to share his novel approach to bug bounty hunting.
330
Firefox Private Browsing mode upgrade
October is one of our favorite months of the year with autumn and Cybersecurity Awareness Month. We’re supporting Cybersecurity Awareness with Private Br