241
242
Unpacking the Benefits of Zero Trust Architecture as Defined by NIST
NIST has released a draft of SP 1800-35 , Implementing a Zero Trust Architecture. The lengthy documents lay out their definition of Zero Trust Architecture (ZTA) , the benefits, why it’s important, a few examples of how an organization can implement them, expected results associated with their example builds, and a…
243
Operation Triangulation: iOS devices targeted with previously unknown malware
While monitoring the traffic of our own corporate Wi-Fi network, we noticed suspicious activity that originated from several iOS-based phones. Since it is impossible to inspect modern iOS devices from the inside, we created offline backups of the devices, inspected them and discovered traces of compromise.
244
245
246
247
SFPD obtained live access to business camera network in anticipation of protest
New documents EFF received through public records requests have revealed that the San Francisco Police Department (SFPD) received live access to the hundreds of surveillance cameras that comprise the Union Square Business Improvement District’s (USBID) camera network in anticipation of potential...
248
Cloudflare mitigated yet another Okta compromise
On Wednesday, October 18, 2023, we discovered attacks on our system that we were able to trace back to Okta. We have verified that no Cloudflare customer information or systems were impacted by this event because of our rapid response.
249
Norway takes a stance against Google Analytics
Norway is the latest country to declare Google Analytics in violation with the GDPR
250
US Senator: What Do Our Cars Know? and Who Do They Share That Information With?
U.S. Senator Ed Markey of Massachusetts has sent a much-needed letter to car manufacturers asking them to clarify a surprisingly hard question to answer: what data cars collect? Who has the ability to access that data? Private companies can often be a black box of secrecy that obscure basic facts...
251
Is Google reCAPTCHA GDPR Compliant?
Achieve engineered efficiency, uncompromising quality, and long-term stability with our software solutions. We optimize your processes, ensure resilience, and support your growth—so you can focus on what matters most.
252
An Opinionated Yubikey Set-Up Guide
How to set up a YubiKey 5 in 2023.
253
Google's OSS-Fuzz expands fuzz-reward program
Posted by Oliver Chang, OSS-Fuzz team Since launching in 2016 , Google's free OSS-Fuzz code testing service has helped get over 8800 vul...
254
Windows Protected Print Mode
Over the past year, the MORSE team has been working in collaboration with the Windows Print team to modernize the Windows Print System. This new design,...
255
Are mental health apps better or worse at privacy in 2023?
Privacy Not Included was launched in 2017 to help you understand the privacy risks of tech products that connect to the internet. We are continuing that work in the form of Product Reviews at our magazine Nothing Personal, where our privacy experts do hours of hands-on testing and research on the most popular consumer…
256
How to catch a wild triangle
How Kaspersky researchers obtained all stages of the Operation Triangulation campaign targeting iPhones and iPads, including zero-day exploits, validators, TriangleDB implant and additional modules.
257
Blueprint for a distributed multi-region IAM with Go and CockroachDB
Learn how to scale IAM globally. Ory provides secure multi-region identity solutions.
258
NYPD can use more than 15,000 cameras to track people using facial recognition
Thousands of volunteers helped map surveillance cameras that the NYPD could use to track people using facial recognition.
259
260
PyPI has completed its first security audit
We are proud to announce PyPI's first external security audit.
261
Noyb files GDPR complaint against Meta over "Pay or Okay"
Meta charges up to €251.88 to respect the fundamental right to privacy of EU users. This is a violation of the GDPR
262
Passage by 1Password: Add passkey support to your app or website
Expert articles, security news, product updates, guides, and research from 1Password on password management, privacy, and digital security.
263
264
37C3: Fuzzing the TCP/IP Stack
Our exploration begins with an honest appraisal of traditional fuzzing methodologies that have been applied to TCP/IP stacks before, like ISIC, revealing their inherent limitations, e.g., they can't reach beyond the TCP initial state. Recognizing the need for a more evolved approach, we take a different approach…
265
266
Inception: A simple XOR can cause a Microarchitectural Stack Overflow
Over the past one and a half years, we have studied two phenomena that enable an unprivileged attacker to leak arbitrary information on all modern AMD CPUs:
267
Zimbra 0-day used to steal email data from government organizations
TAG’s discovery of a 0-day exploit used to steal email data from international government organizations.
268
A Year in Review of 0-days Exploited In-the-Wild in 2022
Maddie Stone, Security Researcher, Threat Analysis Group (TAG) This is Google’s fourth annual year-in-review of 0-days exploited in-the-wild...
269
After 28 years, SSLv2 is still not gone from the internet
After 28 years, SSLv2 is still not gone from the internet... but we're getting there, Author: Jan Kopriva
270
Cloudflare launches easy to set up consent manager that respects users
Cloudflare Zaraz now can also help you with gathering and managing consent. With this new tool, you can easily collect user’s consent preferences on your website, using a consent modal, and apply your consent policy on third-party tools you load via Cloudflare Zaraz