31
What You Get After Running an SSH Honeypot for 30 Days
Discover what 11,599 SSH login attempts reveal after running a honeypot for 30 days. Learn key cybersecurity insights—read now to protect your systems!
32
PuTTY vulnerability vuln-p521-bias
Home | FAQ | Feedback | Licence | Updates | Mirrors | Keys | Links | Team Download: Stable · Snapshot | Docs | Privacy | Changes | Wishlist
33
34
Handling cookies is a minefield
Discrepancies in how browsers and libraries handle HTTP cookies, and the problems caused by such things.
35
How to get the whole planet to send abuse complaints to your best friends
It all begins with one scary email late at night just before I had to go to sleep:
36
Xz/liblzma: Bash-stage Obfuscation Explained
Yesterday Andres Freund emailed oss-security@ informing the community of the discovery of a backdoor in xz/liblzma, which affected OpenSSH server (huge respect for noticing and investigating this). Andres' email is an amazing summary of the whole drama, so I'll skip that. While admittedly most juicy and interesting…
37
EU to greenlight Chat Control tomorrow
[Update: Vote has been postponed to Thursday, keep up the pressure!] The Belgian EU Council presidency seems set to have bulk Chat Control searches of our private communications greenlighted by EU governments on Wednesday 19 Thursday 20 June. This confirms concerns that the proponents of Chat Con
38
Xz: A microcosm of the interactions in open source projects
Originally a thread on Twitter about the xz/liblzma vulnerability, when I finished typing it, I realized I had a real world slice of Open Source interaction that deserved more attention.
39
They stole my voice with AI
UPDATE 9/23: The CEO of Elecrow responded. I've posted a follow-up blog post with my reaction to the response and some other thoughts on AI voice cloning. Listen to this clip: Your browser does not support the video tag. I don't know about you, but that sounds pretty familiar. I mean I would like you to subscribe to…
40
ShotSpotter: listening in on the neighborhood
Last week, someone leaked a spreadsheet of SoundThinking sensors to Wired . You are probably asking "What is SoundThinking," because the company rebranded last year. They used to be called ShotSpotter, and their outdoor acoustic gunfire detection system still goes by the ShotSpotter name.
41
Reverse Engineering iOS 18 Inactivity Reboot
Wireless and firmware hacking, PhD life, Technology
42
Fuzzing Ladybird with tools from Google Project Zero
While Ladybird does an okay job with well-formed web content, I thought it would be useful to throw some security research tools at it and see what kind of issues it might reveal.
43
I looked through attacks in my access logs
I've been self-hosting for over a decade. It's freeing because I own my data, and do not depend on any platform other than my cloud host, which I can easily switch off. Self-hosting gives much insight into what it takes to run a cloud service. Anyone
44
Fixing an Elgato HD60 S HDMI capture device with the help of Ghidra
This post has a little bit of everything. Hardware diagnostics, some suspiciously similar datasheets from two separate Taiwan chip manufacturers, and firmware reverse engineering. Read on if that sounds like fun!
45
How did Facebook intercept their competitor's encrypted mobile app traffic?
A technical investigation into information uncovered in a class action lawsuit that Facebook had intercepted encrypted traffic from user's devices running the Onavo Protect app in order to gain competitive insights.
46
Cracking Meta's Messenger Certificate Pinning on macOS
Bypassing certificate pinning in Meta’s Messenger application on macOS.
47
Why I use Firefox
I’m interested in HTML, CSS, and making the web less annoying
48
GitHub notification emails used to send malware
Malicious actors are abusing legitimate notification emails sent by GitHub to try and trick people into downloading malware.
49
Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws
Dynamic languages are safe from memory corruptions bugs, right?
50
You can't leak users' data if you don't hold it
When I was still working at Faculty , we took on a new client that was not yet named Matter . We eventually transitioned from an agency-client relationship to a startup relationship, where I became the VP of Technology. This is what I’ve been doing for the past two-ish years.
51
A supply chain attack on PyTorch
Security tends to lag behind adoption, and AI/ML is no exception. Four months ago, Adnan Khan and I exploited a critical CI/CD vulnerability in PyTorch, one of the world’s leading ML platform…
52
I Followed the Official AWS Amplify Guide and Was Charged $1,100
An interesting thing happens when you follow the official Amplify guide.
53
Zero-Click Calendar invite vulnerability chain in macOS
Critical zero-click vulnerability chain in macOS (patched)
54
Hacking into an insurance company by exploiting their premium calculator
A vulnerable API on Toyota Tsusho Insurance Broker India’s premium calculator website exposed Microsoft corporate cloud credentials.
55
Using Ghidra and Python to reverse engineer Ecco the Dolphin
Re-routing the encryption
56
Companies embracing SMS for account logins should be blamed for SIM-swap attacks
[UPDATE Since this was posted in 2024 : Major US telcos like AT&T, T-Mobile, and Verizon have suffered a months-long breach (the ongoing Salt Typhoon attack). These companies, of course, pass along the unencrypted SMSes vital to countless log in flows, account re-activations, and password resets. They are now known to…
57
Recall: Stealing everything you've ever typed or viewed on your own Windows PC
Photographic memory comes to Windows, and is the biggest security setback in a decade.
58
59
Attacking UNIX Systems via CUPS
Hello friends, this is the first of two, possibly three (if and when I have time to finish the Windows research) writeups. We will start with targeting GNU/Lin…
60
Apple Passwords’ generated strong password format
This post briefly summarizes part of a talk I gave in 2018. All information in this post has been accessible on YouTube since then. There is no new information or news in this post. On Mastodon recently, jsveningsson@mastodon.social asked me: Having an annoying argument on Threads about Apple generated passwords…