301
302
Nextdoor's Heisensubscribe (and Other Dark Patterns)
Nextdoor's notification settings are hostile. This is not an isolated incident.
303
Give Me the Green Light Part 1: Hacking Traffic Control Systems
Adventures in Responsible Disclosure
304
SELinux bypasses
This post aims at giving an overview of what SELinux is, how it is implemented, and how to bypass it, from the point of view of Android kernel exploitation.
305
Passkey Implementation: Misconceptions, pitfalls and unknown unknowns
Read about the challenges, pitfalls and misconceptions we faced while developing our passkey-first authentication solution and passkey intelligence.
306
GCC's new fortification level: The gains and costs (2022)
Discover the gains and costs of GCC’s enhanced runtime buffer overflow protection. Level 3 _FORTIFY_SOURCE preprocessor macro may detect more buffer overflows, but there’s a cost.
307
Owners of 1-Time Passcode Theft Service Plead Guilty
Three men in the United Kingdom have pleaded guilty to operating otp[.]agency , a once popular online service that helped attackers intercept the one-time passcodes (OTPs) that many websites require as a second authentication factor in addition to passwords.
308
Bypassing Denuvo in Hogwarts Legacy
When I announced my Black Ops 3 integrity bypass, someone commented that my research was not impressive and I should try analyzing Denuvo instead. That kinda stuck with me, so I did what everyone would do and spent the last 5 months of my free time reverse engineering and bypassing the Denuvo DRM in Hogwarts Legacy. I…
309
The AWS S3 Denial of Wallet Amplification Attack
If you publicly host large data files on AWS S3 & pay for transfer costs, you may be vulnerable to a “Denial of Wallet” amplification…
310
Bootkitty: Analyzing the first UEFI bootkit for Linux
ESET's discovery of the first UEFI bootkit designed for Linux sendss an important message: UEFI bootkits are no longer confined to Windows systems alone.
311
The Beginner's Guide to Visual Prompt Injections (2023)
Learn about visual prompt injections, their appearance, and top defense strategies against these attacks.
312
The epidemic of fraudulent DMCA takedowns
There’s an enormous and largely invisible campaign to use fraudulent notices under the US Digital Millennium Copyright Act to remove critical articles from the internet. We don’t know who is running…
313
Hiding Linux Processes with Bind Mounts
Lately I’ve been thinking about Stephan Berger’s recent blog post on hiding Linux processes with bind mounts. Bottom line here is that if you have an evil process you want to hide, use …
314
Advancing Our Bet on Asymmetric Cryptography
Google and many other organizations, such as NIST, IETF, and NSA, believe that migrating to post-quantum cryptography is important due to the large risk posed by a crypt…
315
Samsung's abandoned NX cameras can be brought online with a $20 LTE stick
Tooting photos on the go from Samsung WiFi cameras with a $20 LTE stick
316
Researchers: Weak Security Defaults Enabled Squarespace Domains Hijacks
At least a dozen organizations with domain names at domain registrar Squarespace saw their websites hijacked last week. Squarespace bought all assets of Google Domains a year ago, but many customers still haven’t set up their new accounts. Experts say malicious hackers learned they could commandeer any migrated…
317
318
How deceptive design is used to compromise your privacy and how to fight back
Today, we’re releasing a new guide explaining how to compel companies employing deceptive design to dodge data protection requests—like those for data deletion or access—to comply. It encapsulates five years...
319
Fuzzing between the lines in popular barcode software
Fuzzing—one of the most successful techniques for finding security bugs, consistently featured in articles and industry conferences—has become so popular that you may think most important software has already been extensively fuzzed. But that’s not always the case. In this blog post, we show how we fuzzed the ZBar…
320
How random are TOTP codes?
I'm pretty sure that the 2FA codes generated by my bank's TOTP app have a bias towards the number 8 - because eight is an auspicious number. But is that just my stupid meaty brain noticing patterns where none exist? The TOTP algorithm uses HMAC, which in turn uses SHA-1. My aforementioned brain is not clever enough to…
321
From object transition to RCE in the Chrome renderer
In this post, I'll exploit CVE-2024-5830, a type confusion in Chrome that allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site.
322
The /unblock API from Browserless: dodging bot detection as a service
The /unblock API clears away bot fingerprints at the CDP level, to truly humanize your Puppeteer automations.
323
The xz backdoor thing reminds me of a story
This xz backdoor thing reminds me of a story I heard from friends that worked at a tech company that made cell phones. They had a great coder that worked on the project, he had put in work as a contractor for a few months, and due to the quality of his work he was hired in full time. After two months he simply stopped…
324
Using YouTube to steal your files
A writeup of my $4133.70 Google Drive vulnerability chain.
325
Using Large Language Models to Catch Vulnerabilities
Posted by the Big Sleep team Introduction In our previous post, Project Naptime: Evaluating Offe...
326
An unexpected journey into Microsoft Defender's signature World
Microsoft Defender is the endpoint security solution preinstalled on every Windows machine since Windows 7. It's a fairly complex piece of software, addressing both EDR and EPP use cases. As such, Microsoft markets two different products. Microsoft Defender for Endpoint is a cloud based endpoint security solution that…
327
I'm blocking connections from AWS to my on-prem services
The direct result of bulletproof infrastructure / cloud providers which are "too big to fail" is the balkanized internet . I don't think this has fully come to pass, but it might be starting to happen or might come to pass soon.
328
macOS Sonoma silently enabled iCloud Keychain despite my precautions
This is a follow-up to my blog post Updating from macOS Ventura to Sonoma silently enables iCloud Keychain . In the addendum to that blog post, I discussed a workaround, which was to delete my WiFi password right before rebooting into the updater. In a trial run on my M1 Mac mini, the workaround was successful.
329
Dnsmasq wins the first BlueHats Prize
BlueHats prizes is an initiative by the French Interministerial Digital Directorate. They are awarded to maintainers of critical free and open source projects. In 2024 four prizes of € 10 000 each will be given out. We are happy to announce the winner of the first 2024 BlueHats prize is Simon Kelley, maintainer of the…
330
Proposed UN cybercrime treaty has evolved into an expansive surveillance tool
EFF has joined forces with 110 NGOs today in a joint statement delivered to the United Nations Ad Hoc Committee, clearly outlining civil society non-negotiable redlines for the proposed UN Cybercrime Treaty, and asserting that states should reject the proposed treaty if these essential changes are...