We're excited to announce a contribution to improving privacy for everyone on the Internet. Encrypted Client Hello, a new standard that prevents networks from snooping on which websites a user is visiting, is now available on all Cloudflare plans.
My sister’s stalker, who had used Instagram and Bumble to work out where she lived and start stalking her in real life, was recently…
One of the oldest malware tricks in the book — hacked websites claiming visitors need to update their Web browser before they can view any content — has roared back to life in the past few months. New research shows the attackers behind one such scheme have developed an ingenious way of keeping their malware from…
My friend gave me permission to hack her, here's how I did it and how to stop it happening to you.
Uber has widely adopted Golang (Go for short) as a primary programming language for implementing backend services and libraries due to its high performance. The Go monorepo is the largest codebase at Uber, comprising 90 million lines of code (and growing). This makes tooling for writing reliable Go code a critical…
OAuth Account Takeover. Salt Labs shows how hackers could abuse OAuth to take over millions of accounts on Grammarly, Vidio, and Bukalapak.
Here’s how to get into a lot of trouble: Suppose you (like me) love the intellectual wealth found in free-form text on the Internet. And (like me) are a reasonably competent programmer. And (like me) have derived value and pleasure searching Twitter. And (like me) you look at this nifty new Fediverse thing and see…
This post is a copy of tweets by Zooko Wilcox-O'Hearn . SHA256 was designed by the NSA. BLAKE (the original) and BLAKE3 were designed by Jean-Philippe Aumasson
If you were deciding on whether to use AWS, Azure or Google Cloud for a production application, what factors would you use to make the decision? There are probably many such factors you might think of, but I'd like to point out one that probably isn't commonly considered: the relative trustworthiness of Google's…
Criminals are disguising malware as popular software, so users need to think twice before clicking the download button.
The Call of the Open Sidewalk [The Call of the Open…2023239 points149 commentsSecurity & Privacy details
Update: NIST released a draft that modified their recommendations (Oct 2024) 1) . RSA 2048 is to be only considered “deprecated” after 2030. The draft states:
Several domain names tied to Genesis Market , a bustling cybercrime store that sold access to passwords and other data stolen from millions of computers infected with malicious software, were seized by the Federal Bureau of Investigation (FBI) today. The domain seizures coincided with more than a hundred arrests in…
VSS Hardware Hacking Wiki and Blog Entries
I work in a company that uses custom electronic boards, so there are plenty of instruments floating around that electrical engineers employ to debug faulty connections and solderings. One kind of tools used are the oscilloscopes, tools that measure signals and plot them in a graphically understandable way. We have a…
Malware is being distributed through Minecraft mods and modpacks mainly through CurseForge
This blog post doesn't have the answers. I'm trying to learn about passkeys, but I don't claim to be an expert. I do have a lot of questions, especially for Apple, because I'm an Apple user and developer. According to Betteridge's law of headlines , "Any headline that ends in a question mark can be answered by the…
Debuggers serve as invaluable tools that empower developers to halt code execution and thoroughly analyze its behavior at any given moment. By utilizing debuggers, developers can efficiently identify and resolve issues within their code, making it an indispensable part of their toolkit.
Authors: PromptArmor and Kai Greshake
This article assumes you’ve already heard about the aCropalypse vulnerability, aka CVE-2023-21036. If not, go read about it here (oops, this page doesn't exist yet. Read this tweet in the meantime).
This weekend I went to BSides SF 2023 and had a blast. I went to some really interesting talks (including an excellent one about adversarial machine learning), but mostly I spent my time solving CTF hacking challenges. And this time, I did it with the help of GPT-4, the
This week, the European Parliament's negotiators reached a broad majority agreement on a common position concerning the controversial EU chat control bill. The Commission’s bill proposes bulk scanning and reporting of private messages for allegedly suspicious content by using error-prone algorithms,
We identified three independent remote code execution (RCE) vulnerabilities in the popular Counter-Strike: Global Offensive game. Each vulnerability can be triggered when the game client connects to our malicious python CS:GO server. This post details our journey through the CS:GO binary and conducts a technical deep…
Deliver modern applications with NGINX. Explore high-performance load balancing, API gateways, and web server solutions trusted by top global enterprises.
Starting later this year, we are updating our inactivity policy for Google Accounts to 2 years across our products.
The official videos from DEFCON 31 have been posted! Below you can watch our talk “Snoop unto them as they snoop unto you”. The talk, slides, files
Mac's Tech Blog
This is a story consisting of several little building blocks and they occurred spread out in time and in different places. It is a story that shows with clarity how our current system with CVE Ids and lots of power given to NVD is a completely broken system. CVE-2020-19909 On August 25 2023, we got … Continue reading…
For the past two years we've been tinkering with a proof-of-concept decryptor for the Phobos family ransomware. It works, but is impractical to use for reasons we'll explain here. Consequently, we've been unable to use it to help a real-world victim so far. We've decided to publish our findings and tools, in hope that…
What’s going on? Starting on August 24th, we will no longer support the anonymous creation of rooms on meet.jit.si, and will require the use of an account (we will be supporting Google, GitHub and Facebook […]
