271
272
How my brother's iCloud account was stolen
My brother got his iPhone stolen at gunpoint. This is the story of how he lost control of his iCloud account first (along with years of priceless memories, including my nephew's first steps) and how this couldn't have happened without Apple's incompetent support.
273
Rust Cryptography Should Be Written in Rust
Rust should be improved to provide the necessary building blocks that are needed to write cryptography code that is free from timing side channels and similar hazards. These facilities should not be restricted to code within Rust -provided or -endorsed libraries; anybody should be able to use them to publish a crate…
274
275
Calling time on DNSSEC: The costs exceed the benefits
I’m calling time on DNSSEC. Last week, prompted by a change in my DNS hosting setup, I began removing it from the few personal zones I had signed. Then this Monday the .nz ccTLD experienced a multi-day availability incident triggered by the annual DNSSEC key rotation process. This incident broke several of my unsigned…
276
Reversing 'France Identité': The New French Digital ID
-------------- Update from 06/10/2023 : following my publication, I’ve been in contact with France Identité CISO and they could provide mo...
277
What is the point of a public key fingerprint?
What is the point of a public key fingerprint? What does it do that the public key itself doesn't do. This post explains.
278
How secure is merely discarding (TRIMing) all of a SSD's blocks?
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
279
What Transport for London can learn about us from our mobile data
Big Brother meets Big Data
280
A gentle introduction to static analyzers for C
One of the great thing about C are the many fairly mature tools in the ecosystem. The bad news however is that most educational materials don't teach them and thus many beginners (and sometimes even experienced) developers have absolutely no awareness that these tools even exists.
281
The quest for a family-friendly password manager
Personal blog of Julien (jvoisin) Voisin
282
Enable ARMv9 Memory Tagging Extension (MTE) on Pixel 8
The Pixel 8 hardware ( Tensor G3 ) supports the ARM Memory Tagging Extension (MTE) , and software support is available both in Android userspace and the Linux kernel. This feature is a powerful defense against linear buffer overflows and many types of use-after-free flaws. I’m extremely happy to see this hardware…
283
TOFU: Do You Check?
Let’s say you’re on a fresh machine. Maybe you’ve just started a new job or you’ve wiped your machine. You’re about to push some code you’ve written and you get this: $ git push The authenticity of host 'github.com (140.82.121.4)' can't be established. ED25519 key fingerprint is…
284
We Were Wrong About the GPLs
an unsurprising admission in Conservancy v. Vizio
285
Trust-based moderation systems
master's thesis research into subjective, trust-based moderation systems
286
Deobfuscating World of Warships' Python Scripts
An in-depth analysis of how World of Warships obfuscates its game scripts and how to mostly deobfuscate them automatically.
287
Seized Genesis Market data is now searchable in Have I Been Pwned
A quick summary first before the details: This week, the FBI in cooperation with international law enforcement partners took down a notorious marketplace trading in stolen identity data in an effort they've named "Operation Cookie Monster". They've provided millions of impacted email addresses and passwords to Have I
288
289
OpenAI Begins Tackling ChatGPT Data Leak Vulnerability
OpenAI seems to have implemented some mitigation steps for a well-known data exfiltration vulnerability in ChatGPT. Attackers can use image markdown rendering …
290
Introduction to sysclean(8)
sysclean(8) is a system tool designed for help system administrator to keep their OpenBSD clean after upgrade.
291
Glitching a microcontroller to unlock the bootloader
Back in the summer I was lucky enough to finagle my boss into letting me take Dmitry Nedospasov ( @nedos )’s hardware hacking training . In it I cut my teeth on using an FPGA to interface with target hardware. After implementing a UART we implemented a module that could parse part of Apple’s OneWire, used to negotiate…
292
Phishing Darknet Users for Bitcoins
Writeup of a tool for creating bitcoin stealing phishing clones of onion services on large scale
293
Another cluster of potentially malicious Chrome extensions
I discovered a cluster of at least 109 extensions in Chrome Web Store. A few are committing affiliate fraud or spying, most are simply hoarding overly wide privileges before abusing them.
294
Dismantling a Crappy Malware Operation
Dismantling a Shoddy Malware Operation The Discovery I had been made aware of a malware spreading site called obspremium.com. This site is claiming to offer a so-called “premium” version of the popular open source recording and streaming program Open Broadcaster Software at obsproject.com. “OBS Premium” hosts a direct…
295
Live2D Is a Security Trainwreck
derailed by dangling pointers
296
Linux being secure is a common misconception
Linux being secure is a common misconception in the security and privacy realm. Linux is thought to be secure primarily because of its source model, popular usage in servers, small userbase and confusion about its security features. This article is intended to debunk these misunderstandings by demonstrating the lack…
297
Tempest: Transmit Radio Waves via a PC Video Card with No Extra Hardware
the quality of the music is not exactly what you are used to :-) but at least it works!
298
Lessons from the Debian/OpenSSL Fiasco (2008)
Last week, Debian announced that in September 2006 they accidentally broke the OpenSSL pseudo-random number generator while trying to silence a Valgrind warning. One effect this had is that the ssh-keygen program installed on recent Debian systems (and Debian-derived systems like Ubuntu) could only generate 32,767…
299
Banking Applications Compatibility with GrapheneOS
Maintained Compatibility List for International Banking Apps This list includes banking apps that have been tested, submitted, reviewed, and verified as compatible. LIST | SUBMIT | UPDATE | POSSIBLE WORKAROUND SOLUTIONS Introduction Welcome to the crowd-sourced dataset for GrapheneOS users on currently supported…
300
F-Droid Security Issues
F-Droid is a popular alternative app repository for Android, especially known for its main repository dedicated to free and open-source software. F-Droid is often recommended among security and privacy enthusiasts, but how does it stack up against Play Store in practice? This write-up will attempt to emphasize major…