421
Impact to DigitalOcean customers resulting from Mailchimp security incident
Today, we wanted to share an update about how DigitalOcean and our customers were impacted by a recent security incident disclosed by Mailchimp.
422
423
Global Encryption Day: Demand End-to-End Encryption in DMs
Today is Global Encryption Day, a day to highlight why encryption is critical for a safe, private internet.
424
When Your Smart ID Card Reader Comes With Malware
Millions of U.S. government employees and contractors have been issued a secure smart ID card that enables physical access to buildings and controlled spaces, and provides access to government computer networks and systems at the cardholder’s appropriate security level. But many government employees aren’t issued an…
425
Earn $200K by fuzzing for a weekend: Part 1
By applying well-known fuzzing techniques to a popular target, I found several bugs that in total yielded over $200K in bounties. In this article I will demonstrate how powerful fuzzing can be when applied to software which has not yet faced sufficient testing.
426
Tetsuji: Remote Code Execution on a GameBoy Colour 22 Years Later
Introduction It’s that time of year again - the Binary Golf Grand Prix is back for a third year running! You can also check out my entries to the first and second times this amazing competition ran. The theme this year was to produce a binary that crashes a given program. Bonus points for hijacking execution…
427
Battle with bots prompts purge of Amazon, Apple employee accounts on LinkedIn
On October 10, 2022, there were 576,562 LinkedIn accounts that listed their current employer as Apple Inc. The next day, half of those profiles no longer existed. A similarly dramatic drop in the number of LinkedIn profiles claiming employment at Amazon comes as LinkedIn is struggling to combat a significant uptick in…
428
Own your calendar and contacts with OpenBSD, Baïkal, and FOSS Android
Writer for Semaphore and ButterCMS. Previously Staff Engineer at Deliveroo and in technical leadership at various public sector organisations.
429
DNS-over-HTTP/3 in Android
Posted by Matthew Maurer and Mike Yu, Android team To help keep Android users’ DNS queries private, Android supports encrypted DNS. I...
430
A Year-End Letter from our Executive Director
This letter was originally published in our 2022 annual report. The past year at ISRG has been a great one and I couldn’t be more proud of our staff, community, funders, and other partners that made it happen. Let’s Encrypt continues to thrive, serving more websites around the world than ever before with excellent…
431
Protect your privacy and your phone number with Firefox Relay
When you share your personal phone number with anyone outside your circle of family and friends, it essentially gives them permission to call you anytime o
432
Another Vulnerability in the LPC55S69 ROM
The discovery of an undocumented hardware block in the LPC55S69.
433
Chaos Computer Club saves the German healthcare system 400M Euros
Zur Verbindung mit dem Gesundheitsdatennetz „Telematik“ sind in deutschen Arztpraxen spezielle Router vorgeschrieben. Nach nur fünf Jahren Laufzeit soll nun ein Gerätetausch alternativlos sein – so...
434
Mullvad Privacy Companion is now open source
Mullvad Privacy Companion, a free Firefox extension helping to improve your online privacy – is now open source.
435
Your phone may soon replace many of your passwords
Apple , Google and Microsoft announced this week they will soon support an approach to authentication that avoids passwords altogether, and instead requires users to merely unlock their smartphones to sign in to websites or online services. Experts say the changes should help defeat many types of phishing attacks and…
436
Security concerns with the e-Tugra certificate authority
Certificate authorities (CAs) are a critical backbone of internet security; when they are compromised, users lose the ability to securely connect to websites without fear of interception. Websites cannot insulate themselves against a fully-compromised CA, even if they normally use other CAs.
437
Reversing a 2.4GHz Remote Control
I have an old project on Github called rf-car for controlling a radio car with HackRF. A few months ago, my daughter received a new RC car made by Dickie Toys :
438
439
T-Mobile USA doesn't comply with its German parent company’s GDPR policies
The Practical Nomad: Edward Hasbrouck's blog
440
Lockdown: The coming war on general-purpose computing (2012)
This article is based on a keynote speech to the Chaos Computer Congress in Berlin, Dec. 2011.
441
Mitmproxy 9: WireGuard Mode
We’re excited to announce the release of mitmproxy 9, a free and open source interactive HTTPS proxy. This release brings support for raw UDP and DTLS, a new WireGuard proxy mode, and major usability improvements.
442
Why to not use JWT (2021)
We build advanced web apps
443
Some discouraging anecdotes on how services handle account deletions
I asked 124 services to delete my user account. The results were mixed. 21 never responded, and 16 responded by created even more accounts. Some outright lied.
444
Spring Core on JDK9 is vulnerable to remote code execution
Update: March 31, 2022 A patch has officially been released. https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement https://tanzu.vmware.com/security/cve-2022-22965 Overview Spring Core on JDK9+ is vulnerable to remote code execution due to a bypass for CVE-2010-1622. At the time of writing, this…
445
Liberating out-of-copyright photos from SmartFrame's DRM
During the middle of the 20th Century, the UK's Royal Air Force took thousands of photographs of the country from above. Think of it like a primitive Google Earth. Those photographs are "Crown Copyright". For photographs created before 1st June 1957, the copyright expires after 50 years. Recently, the organisation…
446
Brave New Trusted Boot World
Posts and writings by Lennart Poettering
447
A planned EU regulation about website certificates is causing concern
Feisty Duck’s Cryptography & Security Newsletter is a periodic dispatch bringing you commentary and news surrounding cryptography, security, privacy, SSL/TLS, and PKI. It's designed to keep you informed about the latest developments in this space. Enjoyed every month by more than 50,000 subscribers. Written by Hanno…
448
Rolling-PWN vulnerability affects all Honda vehicles
Modern vehicles are often equipped with a remote keyless entry system. These RKE systems allow unlocking or starting the vehicle remotely. The goal of our research was to evaluate the resistance of a modern-day RKE system. Our research disclosed a Rolling-PWN attack vulnerability affecting all Honda vehicles currently…
449
Bluetooth signals can be used to identify and track smartphones
A team of engineers at the University of California San Diego has demonstrated for the first time that the Bluetooth signals emitted constantly by our mobile phones have a unique fingerprint that can be used to track individuals’ movements.
450
Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare
Any website can use a simple API to replace CAPTCHAs with our invisible alternative, whether they’re on the Cloudflare network or not.