241
Do you need ID to read the REAL-ID rules?
[“The welcoming, friendly and visually pleasing appearance” of the TSA’s headquarters at 6595 Springfield Center Drive, Springfield, VA.]
242
A memory leak in Apple's Network Extension framework
Is it normal for the Little Snitch Network Extension to consume Gigabytes of memory? No it isn’t. Unfortunately that’s another new bug in the Network Extension framework of macOS. It’s a memory leak in Apple’s framework, which developers…
243
Exodus Bitcoin Wallet: $490k swindle
Edit: There’s a short follow-up to this post: Exodus Bitcoin Wallet: Follow up. tl;dr: A Bitcoin investor was recently scammed out of 9 Bitcoin (worth around $490K) in a fake “Exodus wallet” desktop application for Linux, published in the Canonical Snap Store. This isn’t the first time, and if nothing changes, it…
244
Inside the failed attempt to backdoor SSH globally that got caught by chance
Why the threat actor rushed deployment.
245
Phish-friendly domain registry ".top" put on notice
The Chinese company in charge of handing out domain names ending in “ .top ” has been given until mid-August 2024 to show that it has put in place systems for managing phishing reports and suspending abusive domains, or else forfeit its license to sell domains. The warning comes amid the release of new findings that…
246
We build X.509 chains so you don't have to
For the past eight months, Trail of Bits has worked with the Python Cryptographic Authority to build cryptography-x509-verification, a brand-new, pure-Rust implementation of the X.509 path validation algorithm that TLS and other encryption and authentication protocols are built on. Our implementation is fast…
247
Entropic Engineering DEFCON 32 Statement
Entropic Engineering was approached in January ‘24 by the DEFCON Badge Team, who were looking for a small company to partner with. They expressed that they specifically wanted to work with us as a woman-owned, queer- and POC-driven engineering firm to develop an electronic badge with a gaming element for this year’s…
248
A High-Level Technical Overview of Homomorphic Encryption
About two years ago, I switched teams at Google to focus on fully homomorphic encryption (abbreviated FHE, or sometimes HE). Since then I’ve got to work on a lot of interesting projects, learning along the way about post-quantum cryptography, compiler design, and the ins and outs of fully homomorphic encryption. If…
249
PyPI now supports digital attestations
Announcing support for PEP 740 on the Python Package Index
250
251
Better-performing “25519” elliptic-curve cryptography
Automated reasoning and optimizations specific to CPU microarchitectures improve both performance and assurance of correct implementation.
252
PiFex: JTAG Hacking with a Raspberry Pi
With this blog post, we'll introduce the PiFex, a basic companion board for the Raspberry Pi designed to teach users the basics of hardware hacking and embedded protocols. We will then demonstrate how to use the PiFex to access a JTAG tap on an undocumented SSD, allowing memory reads and GDB access to the SSD CPU.
253
Passwordless: a different kind of hell?
It's no secret that authenticating into services is an unresolved topic. With time, we have managed
254
I can't use my number pad for 2FA codes
This has to be the most infuriating bug report I've ever submitted. I went to type in my 2FA code on a website - but no numbers appeared on screen. Obviously, I was an idiot and had forgotten to press the NumLock button. D'oh! I toggled it on and typed again. No numbers appeared. I switched to another tab, my numbers…
255
Sunlight, a Certificate Transparency log implementation
Let’s Encrypt is proud to introduce Sunlight, a new implementation of a Certificate Transparency log that we built from the ground up with modern Web PKI opportunities and constraints in mind. In partnership with Filippo Valsorda, who led the design and implementation, we incorporated feedback from the broader…
256
Reverse-Engineering an IP Camera (2019)
A few days ago I had to replace the old IP camera I use to watch over my dogs and cats, and found out that IP cam technology changed a lot since I bought that old camera. IP cameras are now low-price and ubiquitous. I bought one of those generic models and installed it at my home, expecting to use the same software…
257
258
A recent security incident involving Dropbox Sign
Information on a security incident involving Dropbox Sign.
259
260
Tailscale SSH is now Generally Available
Tailscale SSH is now generally available, offering seamless SSH authentication and authorization with SSO, MFA, and ACLs. Enjoy robust security, zero trust remote access, and tools like session recording and VS Code integration.
261
Google Public DNS's approach to fight against cache poisoning attacks
Tianhao Chi and Puneet Sood, Google Public DNS The Domain Name System (DNS) is a fundamental protocol used on the Internet to translate hum...
262
Samsung WB850F Firmware Reverse Engineering
Dissecting and symbol-mapping a camera firmware to get around WiFi hotspot mis-detection
263
Off-path TCP hijacking in NAT-enabled Wi-Fi networks
Guest Post: New off-path TCP hijacking attack in Wi-Fi networks that exploits vulnerabilities in the NAT mapping strategies of routers discovered.
264
The C bounded model checker: criminally underused
Follow along on a google colab: https://colab.research.google.com/github/philzook58/philzook58.github.io/blob/master/pynb/cbmc_tut.ipynb
265
"No way to prevent this" say users of only language where this regularly happens
Xe Iaso's personal website.
266
Déjà vu: Ghostly CVEs in my terminal title
As I've spoken and written about all modern terminals are actually "emulating" something dating from the 1970s.
267
CVE-2024-4367 – Arbitrary JavaScript execution in PDF.js
A vulnerability in PDF.js found by Codean Labs. PDF.js is a JavaScript-based PDF viewer maintained by Mozilla. This bug allows an attacker to execute arbitrary JavaScript code as soon as a malicious PDF file is opened. This affects all Firefox users (
268
Attack of the Week: Airdrop Tracing
It’s been a while since I wrote an “attack of the week” post, and the fault for this is entirely mine. I’ve been much too busy writing boring posts about Schnorr signatures!…
269
New 0-Day Attacks Linked to China's 'Volt Typhoon'
Malicious hackers are exploiting a zero-day vulnerability in Versa Director , a software product used by many Internet and IT service providers. Researchers believe the activity is linked to Volt Typhoon , a Chinese cyber espionage group focused on infiltrating critical U.S. networks and laying the groundwork for the…
270
I discovered a critical exploit in ZeroMQ with mostly pure luck
Fang-Pen Lin's blog about programming