301
302
Top suspect in 2015 Ashley Madison hack committed suicide in 2014
When the marital infidelity website AshleyMadison.com learned in July 2015 that hackers were threatening to publish data stolen from 37 million users, the company’s then-CEO Noel Biderman was quick to point the finger at an unnamed former contractor. But as a new documentary series on Hulu reveals [ SPOILER ALERT! ]…
303
Microsoft Outlook Blocking All Email from Tutanota.com Domain as Spam
Update: Emails from Tutanota.com no longer go to Spam in Outlook.
304
1.1.1.1 lookup failures on October 4th, 2023
On 4 October 2023, Cloudflare experienced DNS resolution problems. Some users may have received SERVFAIL DNS responses to valid queries. In this blog, we’re going to talk about what the failure was, why it occurred, and what we’re doing to make sure this doesn’t happen again
305
Server-side sandboxing: Containers and seccomp
An overview of containers and seccomp as sandboxing primitives
306
Are we doing this again? Yes, we're doing this again
Y esterday I was rudely summoned away from a beautiful autumn day of wild foraging by The King.
307
308
309
Multi-modal prompt injection image attacks against GPT-4V
GPT4-V is the new mode of GPT-4 that allows you to upload images as part of your conversations. It’s absolutely brilliant. It also provides a whole new set of vectors …
310
Cisco can't stop using hard-coded passwords
There’s a new Cisco vulnerability in its Emergency Responder product: This vulnerability is due to the presence of static user credentials for the root account that are typically reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A…
311
Iraq Blocks Telegram, Leaks Blackhole BGP Routes
This past weekend, the government of Iraq blocked the popular messaging app Telegram, citing the need to protect Iraqi’s personal data. However, when an Iraqi government network leaked out a BGP hijack used for the block, it became yet another BGP incident that was both intentional, but also accidental. Thankfully…
312
313
Hardening cellular basebands in Android
Posted by Ivan Lozano and Roger Piqueras Jover Android’s defense-in-depth strategy applies not only to the Android OS running on the Appl...
314
SMS phishers harvested phone numbers, shipment data from UPS tracking tool
The United Parcel Service (UPS) says fraudsters have been harvesting phone numbers and other information from its online shipment tracking tool in Canada to send highly targeted SMS phishing (a.k.a. “smishing”) messages that spoofed UPS and other top brands. The missives addressed recipients by name, included details…
315
Private spies hired by FBI and corporations infiltrate Discord, Reddit, WhatsApp
Leading “threat intelligence” firms are creating fake online personas to gain access to every corner of the web.
316
Hacking the Nintendo DSi Browser
I managed to exploit the Nintendo DSi browser 15 years after it was released in Japan. This post will go over the journey and the technical details.
317
Firefox rolls out Total Cookie Protection by default to more users
Updated Aug. 28, 2024. Take back your privacy Firefox is rolling out Total Cookie Protection by default to more Firefox users worldwide, making Firefox the
318
ldd arbitrary code execution (2009)
The `ldd` utility is more vulnerable than you think. It's frequently used by programmers and system administrators to determine the dynamic library dependencies of executables. Sounds pretty innocent, right? Wrong! In this article I am going to show you how to create an executable that runs arbitrary code if it's...
319
Running one’s own root Certificate Authority in 2023
A tale how running your own x509 root CA – for internal services – changed in the last 20 years.
320
More malicious extensions in Chrome Web Store
So far I discovered 18 malicious extensions with 55 million users in total. Most popular ones are: Autoskip for Youtube, Crystal Ad block and Brisk VPN. They have been active for two years, undetected by Google.
321
322
Delimiters won’t save you from prompt injection
Prompt injection remains an unsolved problem. The best we can do at the moment, disappointingly, is to raise awareness of the issue. As I pointed out last week, “if you …
323
Starlink's User Terminal Firmware
This blog post presents an overview of Starlink's User Terminal runtime internals, focusing on the communications that happen within the device and with user applications and some tools that can help further research on the same topic.
324
GPU.zip: side channel attack that exposes visual data processed on the GPU
On the Side-Channel Implications of Hardware-Based Graphical Data Compression
325
326
Exploiting DNS response parsing on the Wii U
It's annual Wii U exploit time! 😄 Image of the Wii U connection test screen on the GamePad. After reverse engineering parts of the Wii Us' ...
327
Google AMP – The Newest of Evasive Phishing Tactic
Author: Dylan DuncanA new phishing tactic utilizing Google...
328
329
Email Authentication: A Developer's Guide
Learn the importance of SPF, DKIM, DMARC, and BIMI in ensuring email delivery.
330
Chinese app included malware to gain competitive advantage
Google says it has suspended the app for the Chinese e-commerce giant Pinduoduo after malware was found in versions of the software. The move comes just weeks after Chinese security researchers published an analysis suggesting the popular e-commerce app sought to seize total control over affected devices by exploiting…