It feels like not a week goes by without someone sending me yet another credential stuffing list. It's usually something to the effect of "hey, have you seen the Spotify breach", to which I politely reply with a link to my old No, Spotify Wasn't Hacked blog post
noyb filed a complaint against Mozilla for quietly enabling a supposed “privacy feature” (called Privacy Preserving Attribution) in its Firefox browser which tracks user behaviour on websites.
LLMs seem surprisingly good at many things. So much so that not a week goes by without someone coming up with yet another use-case for this technology, often to solve tasks quickly that traditionally took a non-trivial amount of human work to complete. Today’s example was Brendan Dolan-Gavitt’s remarkable experiment…
How to extract raw source protobuf definitions from compiled binaries, regardless of the target architecture
EU member states can now collect and share information on “potential terrorists”. This category is based on a new informal definition that was agreed with no democratic scrutiny. While claiming to target those who may engage in political violence, there is potential for far broader application.
Domien Schepers and Aanjhan Ranganathan, Northeastern University; Mathy Vanhoef, imec-DistriNet, KU Leuven
ISRG has been investing heavily in the Rustls TLS library over the past few years. Our goal is to create a library that is both memory safe and a leader in performance. Back in January of this year we published a post about the start of our performance journey. We've come a long way since then and we're excited to…
A bunch of malicious extensions in Chrome Web Store have hidden affiliate fraud functionality, collect users’ browsing profiles, or both. These extensions appear to be connected to the Karma shopping assistant, developed by Karma Shopping Ltd. which is not a small company.
This blog post provides details about nine vulnerabilities affecting the IPv6 network protocol stack of EDK II, TianoCore's open source reference implementation of UEFI.
polyfill.io, a popular JavaScript library service, can no longer be trusted and should be removed from websites
Europe's top court rules that IAB Europe is responsible under the GDPR for the "TCF" consent system, which authorities have already found to be in violation of the GDPR.
A new security issue was discovered that affects the JetBrains GitHub plugin on the IntelliJ platform, which could lead to disclosure of access tokens to third-party sites. The issue affects all IntelliJ-based IDEs as of 2023.1 onwards that have the JetBrains GitHub plugin enabled and configured/in-use.
Access for Infrastructure, BastionZero’s integration into Cloudflare One, will enable organizations to apply Zero Trust controls to their servers, databases, Kubernetes clusters, and more. Today we’re announcing short-lived SSH access as the first available feature of this integration.
A smartphone’s unique Bluetooth fingerprint could be used to track the device’s user–until now. A team of researchers have developed a simple firmware update that can completely hide the Bluetooth fingerprint, eliminating the vulnerability.
Using local data to answer authorization questions with Oso Cloud
An updated version of the methodology to be used in the Child Sexual Abuse Regulation, leaked by the news portal Contexte, reveals more details on the approach pursued by the Belgian Council Presidency: The text doubles-down on services that allow people to protect themselves. If services are used t
In this blog post, you will learn different methods to harden your OpenBSD system, and in which situation they are useful
Silently sends up to 255 bytes of the client's heap to the server . The server must support NPN , and the heap data is encrypted in transit.
Dmitry.GR: Creating BTLE-compliant advertisement packets, so that iOS and android devices can see and parse them.
The Research Team at Roblox is discovering new possibilities for the next generation of technology.
Last week, the United States joined the U.K. and Australia in sanctioning and charging a Russian man named Dmitry Yuryevich Khoroshev as the leader of the infamous LockBit ransomware group. LockBit’s leader “ LockBitSupp ” claims the feds named the wrong guy, saying the charges don’t explain how they connected him to…
There are indications that U.S. healthcare giant Change Healthcare has made a $22 million extortion payment to the infamous BlackCat ransomware group (a.k.a. “ ALPHV “) as the company struggles to bring services back online amid a cyberattack that has disrupted prescription drug services nationwide for weeks. However…
On Wednesday, March 13, 2024, Let’s Encrypt generated 10 new Intermediate CA Key Pairs, and issued 15 new Intermediate CA Certificates containing the new public keys. These new intermediate certificates provide smaller and more efficient certificate chains to Let’s Encrypt Subscribers, enhancing the overall online…
XNU kernel buffer overflow, introduced in macOS 14.0 and fixed in macOS 14.5.
Don't trust. Verify. I could not resist making a fake book cover Here follows a brief description on how you can detect if the curl package would ever make an xz. xz (and its library liblzma) was presumably selected as a target because it is an often used component and by extension via systemd it … Continue reading…
Scope. To talk about C++’s current safety problems and solutions well, I need to include the context of the broad landscape of security and safety threats facing all software. I chair the ISO C++ s…
Camera traps and drones deployed by government authorities to monitor a forest in India are infringing on the privacy and rights of local women.
While looking for ways to activate the developer menus left over in Animal Crossing, including the NES emulator game selection menu, I found an interesting feature that exists in the original game that was always active, but never used by Nintendo. In addition to the NES/Famicom games that can be obtained in-game, it…
