211
212
Put an io_uring on it: Exploiting the Linux kernel
How much do you know about system calls and how they introduce security risks? We shed light on these interactions and how security teams monitor them.
213
Attack campaign involving stolen OAuth tokens issued to third-party integrators
On April 12, GitHub Security began an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from dozens of organizations, including npm. Read on to learn more about the impact to GitHub, npm, and our…
214
Someone is impersonating us in a recruiting scam
Our startup was recently the center of an elaborate recruiting scam. What do other companies do if they realize that someone is impersonating them to attack vulnerable job seekers? This article gives advice to job seekers and shares our story.
215
216
A pentester gets root - step by step example
DevOops is a retired machine on HackTheBox. This write-up is a walk through the methodology that leads to root shell.
217
SSH Agent Restriction (new in OpenSSH 8.9)
OpenSSH agent restriction
218
HTTPS Everywhere will sunset in January 2023
You no longer need HTTPS Everywhere to set HTTPS by default! Major browsers now offer native support for an HTTPS only mode. Learn how to turn it on.Read more about the sunset of HTTPS Everywhere.Since we started offering HTTPS Everywhere, the battle to encrypt the web has made leaps and bounds....
219
NPM security update: Attack campaign using stolen OAuth tokens
npm's impact analysis of the attack campaign using stolen OAuth tokens and additional findings.
220
RCE over ham radio – Reverse shell via WinAPRS memory corruption bug
This installment will review and demonstrate functional exploits for WinAPRS on both Windows XP SP3 and Windows 10.
221
Norton 360 Now Comes with a Cryptominer
Norton 360 , one of the most popular antivirus products on the market today, has installed a cryptocurrency mining program on its customers’ computers. Norton’s parent firm says the cloud-based service that activates the program and allows customers to profit from the scheme — in which the company keeps 15 percent of…
222
NSA's Backdoor of the PX1000-Cr
In 1983, the PX-1000 pocket telex used DES encryption. But with help of Philips, the NSA managed to replace DES with an alternative (weaker) algorithm that they could break. That NSA algorithm is now broken.
223
Chromium based browsers leak user local IP via WebRTC foundation attribute
This script uses a pregenerated foundation lookup table to find local IP address for ICE candidates that render local mDNS hostnames seen as xx-xxx-xxx-xx.local .
224
Wiretapping Google smart speakers
I was recently rewarded a total of $107,500 by Google for responsibly disclosing security issues in the Google Home smart speaker that allowed an attacker within wireless proximity to install a "backdoor" account on the device, enabling them to send commands to it remotely over the Internet, access its microphone…
225
Attacking an Ethereum L2 with Unbridled Optimism
On 2/2/2022, I reported a critical security issue to Optimism—an "L2 scaling solution" for Ethereum—that would allow an attacker to replicate money on any chain using their "OVM 2.0" fork of go-ethereum (which they call l2geth).
226
Real-world stories of how we’ve compromised CI/CD pipelines
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
227
Shutting down our unencrypted public DNS service
On the 16th January 2023 we will shut down our legacy public DNS service, currently reachable from this IP: 193.138.218.74
228
229
Apple security bounty upgraded
Apple’s Security Bounty program has paid nearly $20 million in rewards to security researchers in just two and a half years. Our new site makes it easier than ever for researchers to submit reports on the web, get real-time updates from Apple engineering, and earn recognition for helping to improve security for the…
230
Hijacking Email with Cloudflare Email Routing
On Tuesday, December 7th 2021 I discovered a critical vulnerability in Cloudflare’s Email Routing service. This vulnerabilty enabled anyone to modify the routing configuration of any domain using the service. A bad actor could have overwritten the destination address to their own email address in order to read any…
231
A practical guide to securing Google Workspace for a startup
View the Fleet handbook.
232
Gitlab Critical Security Release
GitLab release announcements and feature highlights.
233
How to hide your IP address
A field guide to VPNs, proxies, and traffic relaying
234
How to Bypass Cloudflare: A Comprehensive Guide
Learn the best hands-on techniques to bypass Cloudflare Bot Management. Understand how it works, its sensor data, and evade detection.
235
FORCEDENTRY: Sandbox Escape
Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen...
236
Browser in the Browser (BITB) Attack
Providing security research and red team techniques
237
Who keeps an eye on clipboard access?
If there is any feature that “universally” describes the usage of computers, it is the copy/paste pattern. We are used to it, practically all the common graphical user interfaces have support for it, and it magically works.
238
Senators Urge FTC to Probe ID.me over Selfie Data
Some of more tech-savvy Democrats in the U.S. Senate are asking the Federal Trade Commission (FTC) to investigate identity-proofing company ID.me for “deceptive statements” the company and its founder allegedly made over how they handle facial recognition data collected on behalf of the Internal Revenue Service …
239
240
Denmark bans Gmail and Co from schools due to privacy concerns
Denmark's data protection authority follows Dutch and German authorities by raising concerns about Google's GDPR compliance.