Imagine this: an OpenSSH backdoor is discovered, maintainers rush to push out a fixed release package, security researchers trade technical details on mailing lists to analyze the backdoor code. Speculation abounds on the attribution and motives of the attacker, and the tech media pounces on the story. A near miss
Read on to understand how Google currently evaluates the threat landscape related to post-quantum cryptography, and what implications this has for migrating from classical cryptographic algorithms to PQC.
Wiz Research uncovers vulnerabilities in SAP AI Core, allowing malicious actors to take over the service and access customer data.
This blog post is a part of a series about our research toward the next generation of the SecureDrop whistleblowing …
The Drug Enforcement Agency (DEA) and the Transportation Security Administration (TSA) have been working together for years to steal travelers’ money.
Afnic, the association in charge of the .fr top-level domain and several other French overseas and generic TLDs, announced today the release as free software of its tool named IBDNS, standing for Intentionally Broken DNS.
Study of an Android runtime (ART) hijacking mechanism for bytecode injection through a step-by-step analysis of the packer used to protect the DJI Pilot Android application.
Last week an important judicial ruling came down on a very intriguing case about open source license compliance. In this post, I'll talk about what makes it so interesting and potentially impactful across our industry.
This investigation was surprising to me so I thought it would be interesting to share my findings and I hope you'll like it.
In early February 2022, notably just ahead of the Russian invasion of Ukraine, Volexity made a discovery that led to one of the most fascinating and complex incident investigations Volexity had ever worked. The investigation began when an alert from a custom detection signature Volexity had deployed at a customer site…
We’re making updates to show less unoriginal, low-quality content on Search.
Or, how to break all the tools that parse the "Fixes:" tag Kees Cook There was a recent discussion about how Linux's "Fixes" tag, which ...
The FIDO Alliance has published a working draft of a new set of specifications for secure credential exchange that, when standardized and implemented by
[“The welcoming, friendly and visually pleasing appearance” of the TSA’s headquarters at 6595 Springfield Center Drive, Springfield, VA.]
Is it normal for the Little Snitch Network Extension to consume Gigabytes of memory? No it isn’t. Unfortunately that’s another new bug in the Network Extension framework of macOS. It’s a memory leak in Apple’s framework, which developers…
For the past eight months, Trail of Bits has worked with the Python Cryptographic Authority to build cryptography-x509-verification, a brand-new, pure-Rust implementation of the X.509 path validation algorithm that TLS and other encryption and authentication protocols are built on. Our implementation is fast…
Entropic Engineering was approached in January ‘24 by the DEFCON Badge Team, who were looking for a small company to partner with. They expressed that they specifically wanted to work with us as a woman-owned, queer- and POC-driven engineering firm to develop an electronic badge with a gaming element for this year’s…
Announcing support for PEP 740 on the Python Package Index
Automated reasoning and optimizations specific to CPU microarchitectures improve both performance and assurance of correct implementation.
With this blog post, we'll introduce the PiFex, a basic companion board for the Raspberry Pi designed to teach users the basics of hardware hacking and embedded protocols. We will then demonstrate how to use the PiFex to access a JTAG tap on an undocumented SSD, allowing memory reads and GDB access to the SSD CPU.
Let’s Encrypt is proud to introduce Sunlight, a new implementation of a Certificate Transparency log that we built from the ground up with modern Web PKI opportunities and constraints in mind. In partnership with Filippo Valsorda, who led the design and implementation, we incorporated feedback from the broader…
Information on a security incident involving Dropbox Sign.
Tailscale SSH is now generally available, offering seamless SSH authentication and authorization with SSO, MFA, and ACLs. Enjoy robust security, zero trust remote access, and tools like session recording and VS Code integration.
Tianhao Chi and Puneet Sood, Google Public DNS The Domain Name System (DNS) is a fundamental protocol used on the Internet to translate hum...
Guest Post: New off-path TCP hijacking attack in Wi-Fi networks that exploits vulnerabilities in the NAT mapping strategies of routers discovered.
A vulnerability in PDF.js found by Codean Labs. PDF.js is a JavaScript-based PDF viewer maintained by Mozilla. This bug allows an attacker to execute arbitrary JavaScript code as soon as a malicious PDF file is opened. This affects all Firefox users (
Android rolls out theft protection features to safeguard your data before, during and after a theft incident.
