181
Mozilla Monitor Plus: automatically remove your personal info from data brokers
Today, Mozilla Monitor (previously called Firefox Monitor), a free service that notifies you when your email has been part of a breach, announced its new p
182
Reflections on Distrusting xz
Was the ssh backdoor the only goal that "Jia Tan" was pursuing with their multi-year operation against xz?
183
Vulnerabilities in the Feeld dating app
Discover critical Feeld app vulnerabilities from our pentest. See how flaws in security controls expose personal data and learn key fixes.
184
Over 100k Infected Repos Found on GitHub
Secure everything coding agents build, use, and ship - prevent risk before code exists, AutoFix the backlog, and protect the coding agents and supply chain.
185
Canadian man stuck in triangle of e-commerce fraud
A Canadian man who says he’s been falsely charged with orchestrating a complex e-commerce scam is seeking to clear his name. His case appears to involve “triangulation fraud,” which occurs when a consumer purchases something online — from a seller on Amazon or eBay , for example — but the seller doesn’t actually own…
186
European govt air-gapped systems breached using custom malware
ESET Research analyzed two separate toolsets for breaching air-gapped systems, used by a cyberespionage threat actor known as GoldenJackal.
187
A Bug in Early Creative Commons Licenses Has Enabled Copyleft Trolls (2022)
Copyleft trolls, robosigning, and Pixsy.
188
Microsoft actions following attack by nation state actor Midnight Blizzard
Microsoft Security Response Center Blog
189
IPMI
I am making steady progress towards moving the Computers Are Bad enterprise cloud to its new home, here in New Mexico. One of the steps in this process is, of course, purchasing a new server... the current Big Iron is getting rather old (probably about a decade!) and here in town I'll have the rack space for more…
190
Apple curl security incident 12604
tldr: Apple thinks it is fine. I do not. On December 28 2023, bugreport 12604 was filed in the curl issue tracker. We get a lot issues filed most days so this fact alone was hardly anything out of the ordinary. We read the reports, investigate, ask follow-up questions to see what we can learn … Continue reading the…
191
Understanding and avoiding visually ambiguous characters in IDs
Designing a dictionary of visually unambiguous characters for IDs.
192
The V8 Sandbox
V8 features a lightweight, in-process sandbox to limit the impact of memory corruption bugs
193
Entrust Certificate Distrust
Posted by Chrome Root Program, Chrome Security Team Update (09/10/2024): In support of more closely aligning Chrome’s planned compliance ...
194
My cat alerted me to a DDoS attack
A few years ago, my cat gave me my most memorable middle of the night software engineering incident. I was working at a startup, and we didn’t have a formal on-call rotation yet. That was a deliberate decision, since being on-call is painful, and the team was good about just collectively keeping an eye out for urgent…
195
Digital signatures and how to avoid them
Wikipedia’s definition of a digital signature is: A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents. A valid digital signature on a messag…
196
Misunderstanding about the details of how Apply Pay works
Apple Pay is great, but I think there is some misunderstanding out there about the details of how it works.
197
XZ Backdoor: Times, damned times, and scams
Some timezone observations on the recently discovered backdoor hidden in an xz tarball.
198
We hacked Google A.I.
Bard IDOR, a GraphQL directive-overloading DoS that hung Google's backend for 109 seconds, and Workspace data exfiltration via markdown images.
199
Make your electronics tamper-evident
If the police ever have physical access to an electronic device like a laptop, even for five minutes , they can install hardware keyloggers, create images of the storage media, or otherwise trivially compromise it at the hardware, firmware, or software level. One way to minimize this risk is to make devices…
200
How hard can generating 1024-bit primes be?
On the one hand they are easy to explain, they are just numbers that have no factors other than one and themselves, but on the other hand they contain endless complexity. They show up in numerous places, ranging from mathematical concepts and conjectures to interesting looking visualizations and cryptography…
201
202
Lazarus Group laundered $200M from 25 crypto hacks to fiat
Bluenoroff or APT38, more commonly referred to as Lazarus Group is a threat group which has been tied to the North Korean government since as early as 2009 primarily being financially motivated utilizing malware custom built for each target.
203
How we found and fixed an eBPF Linux kernel vulnerability
This blog post takes a look at the years where eBPF was one of the kernel subsystems that grabbed the attention of a lot of security researchers. We will tell the story of how we discovered CVE-2023-2163, what our root-cause analysis process looked like, and what we did to ultimately fix the issue.
204
The six dumbest ideas in computer security (2005)
There's lots of innovation going on in security - we're inundated with a steady stream of new stuff and it all sounds like it works just great. Every couple of months I'm invited to a new computer security conference, or I'm asked to write a foreword for a new computer security book. And, thanks to the fact that it's…
205
I hacked a train toilet
The other day I rode on a Class 800 train in the UK. This is the “Intercity Express” train designed to replace the venerable HST (Intercity 125 with Mark 3 coaches, a train of which I have many memories and which I will dearly miss).
206
Bypassing Safari 17's advanced audio fingerprinting protection
Explore how Safari 17’s new anti-fingerprinting techniques affect audio fingerprinting and browser differentiation.
207
I also hacked my car
Gonçalo MB. My personal website, projects, contacts and stuff.
208
Macaroons Escalated Quickly
Documentation and guides from the team at Fly.io.
209
0day Contest for End-of-Life Devices Announced
The Junkyard contest focuses on deprecated systems, responsible disclosure, and meme-worthy exploits. Join us today!
210
Escaping surveillance capitalism, at scale
Self-hosting and paid subscriptions promise an escape from surveillance capitalism. What guarantees do they really offer, and at what cost?