91
Israel used Palantir technologies in pager attack in Lebanon
A New Book Quietly Reveals That Israel Used Palantir In It's Terrorist Attack On Lebanon.
92
Hacking Subaru: Tracking and controlling cars via the admin panel
On November 20, 2024, Shubham Shah and I discovered a security vulnerability in Subaru’s STARLINK admin panel that gave us unrestricted access to all vehicles and customer accounts in the United States, Canada, and Japan.
93
Data brokers are selling flight information to CBP and ICE
For many years, data brokers have existed in the shadows, exploiting gaps in privacy laws to harvest our information—all for their own profit. They sell our precise movements without our knowledge or meaningful consent to a variety of private and state actors, including law enforcement agencies....
94
Reverse engineering Call of Duty anti-cheat
Interested in Anti-Cheat analysis? I highly recommend checking out Guided Hacking’s Anti-Cheat section. I’ve been reversing Black Ops Cold War for a while now, and I’ve finally decided to share my research regarding the user-mode anti-cheat inside the game. It’s not my intention to shame or promote cheating/bypassing…
95
One-Click RCE in Asus's Preinstalled Driver Software
One-Click RCE in ASUS’s Preinstalled Driver Software Part Two of the ASUS series is out, read it here. Introduction This story begins with a conversation about new PC parts. After ignoring the advice from my friend, I bought a new ASUS motherboard for my PC. I was a little concerned about having a BIOS that would by…
96
Less is safer: Reducing the risk of supply chain attacks
Supply chain attacks are malicious updates that sneak into open source code used by many apps. Here’s how we design Obsidian to ensure that the app is a secure and private environment for your thoughts.
97
Memory Integrity Enforcement
Memory Integrity Enforcement (MIE) is the culmination of an unprecedented design and engineering effort spanning half a decade that combines the unique strengths of Apple silicon hardware with our advanced operating system security to provide industry-first, always-on memory safety protection across our devices …
98
TLS certificate lifetimes will officially reduce to 47 days
The CA/Browser Forum has officially voted to amend the TLS Baseline Requirements to set a schedule for shortening both the lifetime of TLS certificates.
99
100
GitHub MCP exploited: Accessing private repositories via MCP
We showcase a critical vulnerability with the official GitHub MCP server, allowing attackers to access private repository data. The vulnerability is among the first discovered by Invariant's security analyzer for detecting toxic agent flows.
101
Investigating an “evil” RJ45 dongle
Reverse-engineering hardware can be difficult -- but sometimes, all you need is a comfy armchair and some Google Translate.
102
What went wrong inside recalled Anker PowerCore 10000 power banks?
Investigate Anker’s recalled power banks. See how CT scanning uncovers battery defects and improves safety in lithium-ion designs.
103
Google’s OAuth login doesn’t protect against purchasing a failed startup domain
Millions of Americans can have their data stolen right now because of a deficiency in Google’s “Sign in with Google” authentication flow. If you’ve worked for a startup in the past - especially one that has since shut down - you might be vulnerable.
104
How a single line of code could brick your iPhone
Gui Rambo writes about his coding and reverse engineering adventures.
105
Weaponizing image scaling against production AI systems
In this blog post, we’ll detail how attackers can exploit image scaling on Gemini CLI, Vertex AI Studio, Gemini’s web and API interfaces, Google Assistant, Genspark, and other production AI systems. We’ll also explain how to mitigate and defend against these attacks, and we’ll introduce Anamorpher, our open-source…
106
Nx compromised: malware uses Claude code CLI to explore the filesystem
What is s1ngularity-repository? Nx is compromised and the malware steals wallets and API keys using Claude CLI or Gemini.
107
VPN location claims don't match real traffic exits
17 out of 20 popular VPNs exit traffic from different countries than they claim. Dig into what that means and why it matters in our VPN report.
108
Right to root access
right to repair laws should include provisions requiring manufacturers to unlock a device's bootloader (to provide root access) upon consumer request.
109
15,000 lines of verified cryptography now in Python
In November 2022, I opened issue 99108 on Python’s GitHub repository, arguing that after a recent CVE in its implementation of SHA3, Python should embrace verified code for all of its hash-related infrastructure.
110
The protester's guide to smartphone security
Your phone is an essential tool, but it also represents a huge risk to your privacy and security. Understanding these best practices when it comes to securing your smartphone will help keep you and your data safe.
111
Nevada court shuts down police use of federal loophole for civil forfeiture
RENO, Nev.—In a major victory for property rights, today a Washoe County judge ruled that Nevada law enforcement cannot use a federal program to bypass […]
112
Claude Code can debug low-level cryptography
Surprisingly (to me) Claude Code debugged my new ML-DSA implementation faster than I would have, finding the non-obvious low-level issue that was making Verify fail.
113
How the US defense secretary circumvents official DoD communications equipment
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
114
Apple Exclaves
Enhancing kernel isolation, one step at a time.
115
Google shared my phone number
When people started calling my personal mobile number with questions about a voluntary organisation I'm involved with, I was confused: we weren't sharing that number. It turns out that Google had decided to take the number I used to verify my identity for Google Business some years prior and start putting it in Google…
116
Remote code execution via MIDI messages
Blog post about a reverse engineering project
117
4Chan Lawyer publishes Ofcom correspondence
Ofcom — driven by the letter of British law that they are bound to follow, but still Ofcom — are quietly making Britain look (a) very silly and (b) as if we haven’t yet shucked-off the Americ…
118
119
How I discovered a hidden microphone on a Chinese NanoKVM
NanoKVM is a hardware KVM switch developed by the Chinese company Sipeed. Released last year, it enables remote control of a computer or server using a virtu...
120
Privacy doesn't mean anything anymore, anonymity does
Privacy is when they promise to protect your data. Anonymity is when they never had your data to begin with.