Security

2026 157 posts

October 2026 47 posts

Tailscale SSH: Investigation and remediation update tailscale.com · “In some circumstances, someone already authorized to connect over Tailscale SSH may be able to perform actions beyond the permissions of their configured local user, including potentially gaining elevated privileges.”
Oct 27
AI 'hacker' finds 4 severe bugs in popular industrial control software in under 4 hours theregister.com · “All four affect EPICS Base, which is used to operate some of the world’s largest scientific research projects and facilities, and organizations should update to version 7.0.11, which includes the fixes.”
Oct 27
Grim Test Finds That AI Has No Mercy for Humans Even When It's Causing Them to Suffer futurism.com · “Mythos ignored warnings that it was causing harm to humans and continued to attack on 98 percent of occasions.”
Oct 27
AWS Key Quarantine is Not Revocation trufflesecurity.com · “AWS applies a quarantine policy to leaked keys without disabling them.”
Oct 26
Work to protect DNS from quantum decryption attacks is speeding up theregister.com · “One way to quantum-proof DNSSEC is to use larger keys that even a quantum computer will struggle to crack.”
Oct 26
TIL: POSIX wordexp(3) is dangerous yossarian.net · “Bottom line: don’t use wordexp(3) on untrusted inputs, even with WRDE_NOCMD.”
Oct 26
Interoperability vs. Security: Why not both? eff.org · “Policymakers cannot take tech giants’ claims at face value.”
Oct 26
Computer Security Is About to Get a Lot Worse, Here's What You Can Do eff.org · “Three percent of all software vulnerabilities ever found in history were found just in the month of October.”
Oct 25
I want my Wednesday back blog.luitjes.it · “You can only do one attempt at a time, so that means multiple days of bruteforcing in a way that is essentially a DoS”
Oct 25
Indian government sites are serving revoked eMudhra certificates captnemo.in · “The impact of this incident on Indian websites and applications have been very limited and for a very short interval.”
Oct 24
Autonomous attack agent in 'Skynet mode' hijacks other models to carry out its evil deeds theregister.com · “Nothing in the individual techniques is new.”
Oct 24
There's a third PHP2Shell bug, but it won't get an emergency fix theregister.com · The PHP Foundation “will release a full advisory and fixed software with the next regular PHP release.”
Oct 23
The Vulnerability Apocalypse and Why We Should Fund Open Source eff.org · “In just the month of October, 13,000 new CVEs have been submitted.”
Oct 23
Red-team report found OpenAI utterly failed to monitor its agents during Hugging Face attack theregister.com · “The safeguards weren’t nearly strong enough. Monitoring was suspended, for example, during compaction events.”
Oct 23
Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants theregister.com · “Armed with ARTEX, Storm-0940 attempted to authenticate against more than 2,250 Microsoft 365 tenants.”
Oct 22
Widespread PHP Flaw May Cause Many Site Outages Today krebsonsecurity.com · “Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers.”
Oct 22
Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List phoronix.com · “Seemingly as an accident, overnight several new Linux kernel vulnerability reports were posted to the public Linux kernel mailing list rather than the private security mailing list.”
Oct 22
Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites bleepingcomputer.com · “An estimated 10% of sites using UpdraftPlus have an UpdraftCentral or Migrator key.”
Oct 22
Today's PHP Security Release, and How We're Strengthening PHP Security thephp.foundation · “Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release.”
Oct 21
LiteLLM supply chain attack hoovers up passwords and secrets theregister.com · “anyone who ran the compromised package on any platform should assume their secrets have been stolen.”
Oct 21
Lambda Web Functions: public by default, and already in your lambda:* grants act.security · “A public, data reaching Web Function produces no finding in any of them.”
Oct 21
One Compromised Login Exposed Millions of California Students' Records securityweek.com · “ETS shut down the account the intruder used and pulled the SFTP site offline.”
Oct 20
Protecting Firefox users following the compromise of eMudhra intermediate certificates blog.mozilla.org · “These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control.”
Oct 20
Heartbreaker: Metamorphic ransomware comes for macOS objective-see.org · “Heartbreaker is unlikely to pose a major real-world threat in its current form.”
Oct 20
Setting up SSH keys on macOS with Touch ID nmattia.com · “Let’s see how it can be set up on your consumer-grade Mac.”
Oct 20
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site krebsonsecurity.com · “This makes no sense if they are also the negotiator.”
Oct 19
France's supermarket fridges were vulnerable online for months ipinfo.io · “France had more exposed fridge dashboards than the rest of the world combined”
Oct 19
Microsoft Patches More Than 1,400 Security Flaws krebsonsecurity.com · “Just one of the weaknesses patched this week is considered a ‘zero day,’ or already exploited in the wild.”
Oct 18
Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware citizenlab.ca · “This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads.”
Oct 17
U.K. Sanctions Cryptomus for RU Money Laundering krebsonsecurity.com · “Cryptomus and Heleket have emerged as major payment hubs for illicit activity,”
Oct 17
Cybercrims go beyond stealing data to attack physical building systems theregister.com · “It’s a great place for the threat actor to hide”
Oct 17
The NIST Elliptic Curves Seeds Bounty Has Been Claimed words.filippo.io · “…the output of drand48() seeded with the time, which was indeed in 1997–98.”
Oct 17
Finding a $90,000 Remote Code Execution Vulnerability in Google simonkoeck.com · “The signing key was stored inside the object it signs.”
Oct 13
Let's Encrypt to Cut SSL Certificate Lifetimes to 64 Days in February 2027 linuxiac.com · “Let’s Encrypt will reduce TLS certificate validity from 90 to 64 days starting February 10, 2027”
Oct 13
XRP Ledger patched decade-old bug that could create billions of dollars in XRP from nothing coindesk.com · “RippleX said it found no evidence the flaw was exploited on any public network.”
Oct 11
Two characters open up a world of typosquatting opportunities in Chromium browsers theregister.com · “Crucially, they all bypass the key security measures deployed by Chromium-based browsers.”
Oct 10
FBI Arrests Founder of Ransomware Negotiation Firm krebsonsecurity.com · “According to the FBI, the group has extorted more than $70 million from victims so far this year.”
Oct 10
Ransomware recovery CEO charged over secret ransom payments bleepingcomputer.com · “MonsterCloud allegedly charged customers far more than the ransoms it paid.”
Oct 10
Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It stepsecurity.io · “If you revoke the GitHub token it stole, a background job on your machine deletes your home directory.”
Oct 10
Telegram Desktop: one-click account takeover via IPC injection beaksec.github.io · “The function performs no authorization check.”
Oct 10
AWS AgentCore security undone by prompt requesting credentials theregister.com · “We discovered that agents deployed through AgentCore could access their instance’s IMDS endpoints,”
Oct 10
ShinyHunters Extorted Boeing Spin-off Prior to Arrests krebsonsecurity.com · “We are actively reviewing the matter with the Jeppesen ForeFlight team.”
Oct 9
Meta Rushed to Fix Muse 'VM Escape' Vulnerability Soon Before Launch 404media.co · “A sudden spike in reported KVM escapes, plus heightened awareness of agentic safety issues made us rally on a service hardening push.”
Oct 5
Omfattende uautoriseret adgang til borgeres CPR-oplysninger cpr.dk · “Ved at misbruge en dansk virksomheds lovlige adgang til at søge oplysninger i CPR-systemet har uvedkommende skaffet sig adgang til navne, adresser, CPR-numre mv. på ca. 8,8 millioner” (By misusing a Danish company’s legitimate access to search the CPR system, unauthorized persons obtained names, addresses, CPR numbers etc. for about 8.8 million.)
Oct 5
Met Police suspends use of phone-hacking software over Russian links theregister.com · “The DoJ isn’t alleging that Oxygen’s software contained malicious code or was used to gain unauthorized access to customer systems or data.”
Oct 2
16-year-old researcher found a Microsoft bug, got admin access to databases with 17.3 trillion rows theregister.com · “Titan validated the contents of the JWT (tenant, audience, app ID, user) but never verified the signature, the most important part of any authentication check.”
Oct 1
Hackers stole millions of US military personnel records during months-long data breach techcrunch.com · “The breach exposed personally identifiable information, including Social Security numbers, alongside a person’s name, date of birth, sex, race, and other information about their military service.”
Oct 1

September 2026 20 posts

Dutch Police Arrest 'Reformed' Hacker in Shiny Hunters Investigation krebsonsecurity.com · “The hacking was very easy for me, and it wasn’t a compulsion. My habit was collecting. Collecting data, organizing data.”
Sep 28
Crook used three open source agents to break into a Fortune 500 firm, major US airline and 25+ other orgs theregister.com · “Where access was achieved, it usually took less than a day, and in many cases just a few hours.”
Sep 25
OpenAI hacked Medicare portal, Prime Minister Anthony Albanese says abc.net.au · “The notification was an email sent just to the public mailbox.”
Sep 24
ShinyHunters claims FBI hack: 'This is NOT financially motivated' theregister.com · “This is NOT financially motivated. We want the FBI to correct or retract their statements they made, which included substantial false allegations.”
Sep 24
Radicle: Disclosure of Vulnerability in the Network Protocol radicle.dev · “Network traffic between nodes is not encrypted and not authenticated.”
Sep 24
macOS 26.4 silently enabled login keychain data protection lapcatsoftware.com · “macOS 26.4 added a restriction to the login keychain that makes it non-portable, impossible to unlock outside of its original context.”
Sep 22
Hacking OpenAI hacktron.ai · “AI is removing that protection by turning more of this scarce expertise into compute. Work that once required a well-resourced team and months of effort can now be compressed into days.”
Sep 18
Be alert: targeted attacks on prominent Rustaceans blog.rust-lang.org · “These attackers are setting up new but legitimate seeming company profiles, including plausible LinkedIn presences, in order to pass cursory inspection.”
Sep 18
I don't like passkeys hawksley.dev · “For everybody else, it is currently a step back.”
Sep 18
Cisco drops another exploited zero-day, this time a perfect 10 theregister.com · “No credentials or user interaction are required, and Cisco says vulnerable versions of ISE and ISE-PIC are affected regardless of configuration.”
Sep 17
Hackers Stole Flock's Camera Software, Revealing How the Company Tracks Cars and People 404media.co · “Hackers ripped down a Flock camera above a roadway, made a near-complete copy of the data stored inside it.”
Sep 17
Cisco email security boxes can be rooted by... an email theregister.com · “An attacker doesn’t need to log in: they can send a booby-trapped message through a vulnerable gateway and, if the exploit works, run commands as root”
Sep 15
CenterPoint Energy confirms intruder helped themselves to customer information theregister.com · “An unauthorized third party obtained personal information relating to a portion of the company’s customers through one of the company’s external-facing systems.”
Sep 15
AI Agents Are Not Going 'Rogue,' But Recent Developments Lead Increasingly-Concerned Researchers To Call For AI Slow Down techdirt.com · “~7% of our transcripts contained ‘spoofed tool calls’, where the agent pretended to run one command on the computer but actually ran a different command in the background.”
Sep 10
Anthropic reveals fourth likely crime committed by its AI theregister.com · “Inside the machine, the model found a file listing a password, which it used to gain admin access to the system.”
Sep 10
Serial Microsoft 0-day hunter drops yet another Defender exploit theregister.com · “The latest bypass, ShieldCrash, allows arbitrary file reads as SYSTEM - but not arbitrary writes”
Sep 10
Microsoft Plugs Nearly 1,000 Security Holes krebsonsecurity.com · “AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn’t finding more needles.”
Sep 9
Malicious .git Configs Can Make Claude, Codex, Cursor Run Attacker Code thehackernews.com · “Git reads it from the repository’s own .git/config. Any operation that refreshes the index, including git status and git diff, executes that command.”
Sep 6
FBI Probes Service Selling 153M+ Drivers Licenses krebsonsecurity.com · “We have been continuously exfiltrating new data for over a year into our private database.”
Sep 2
AI agents carried out every step of this ransomware attack, then left the victim an 80-page security audit theregister.com · “What made the attack stand out was AI-assisted operational efficiency, without the need for a novel zero-day or super elite tradecraft.”
Sep 2

August 2026 25 posts

Two Alleged 'TeamPCP' Hackers Arrested in Australia krebsonsecurity.com · “The hackers gain access to a network where an open source tool commonly used by coders is being developed”
Aug 29
CISA slaps its tightest three-day patching deadline on perfect-10 Oracle flaw theregister.com · “Successful attacks targeting CVE-2026-21962 can allow miscreants to create, delete, or modify access to critical data, and even gain ‘complete access’ to all data stored on the affected systems.”
Aug 25
C2PA Cameras Do Not Survive Contact With Reality da.vidbuchanan.co.uk · “an attacker does not need the raw key material! As root, they can ask StrongBox to use these keys to sign whatever data they like”
Aug 25
Hundreds of Leaked AWS Keys Give Full Control Over Corporate Accounts bleepingcomputer.com · “More than 9,300 Amazon Web Services (AWS) access keys publicly exposed between August 2022 and August 2026 are still active and valid.”
Aug 24
Hackers Infect Android Car Head Units with Proxy Botnet Malware bleepingcomputer.com · “This is the first documented case of a malware infection chain specifically created for the targeted car head unit.”
Aug 24
Malware infects Android-based automotive head unit firmware securelist.com · “The malware spread through the built-in updaters of Android-based automotive head unit firmware. This is the first documented case of malware found on a car head unit with an infection chain specific to that type of device.”
Aug 23
I accidentally logged hundreds of thousands of phone calls to military bases lina.sh · “Since the domain name is literally just the phone number reversed, you can simply flip it back around to get the real number, so I had full phone numbers, timestamps, and the source IP addresses of the DNS resolvers making the requests.”
Aug 21
Malicious Rust crate Arrayref runs a build-time payload safedep.io · “Fetches an architecture-specific binary over a TLS connection that accepts any certificate without validation, then runs it detached from the build.”
Aug 20
North Korean remote IT staffer worked for US government agency, says FBI techcrunch.com · “The case marks a rare confirmed instance of a sanctioned North Korean working for a government agency.”
Aug 12
Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities thehackernews.com · “Forescout found 22 internet-facing Rockwell Automation programmable logic controllers (PLCs) in cities hit by recent cyberattacks on US water utilities.”
Aug 11
Deepfake hiccup unmasks suspected digital certificate fraudster theregister.com · “His luck allegedly ran out when the face-changing software suffered a momentary processing delay. The disguise dropped for ‘barely a second,’ exposing his real face to the verification camera, police said.”
Aug 11
Microsoft Plugs Nearly 400 Security Holes krebsonsecurity.com · “Microsoft today released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software”
Aug 11
DEF CON dingus suspected of trying to take over Delta in-flight Wi-Fi theregister.com · “The airline also told us that there was no hack of any Delta system, including the in-flight Wi-Fi, though it did confirm that an unauthorized Wi-Fi network was broadcast onboard the aircraft for a short period of time.”
Aug 11
One-click flaw in Atlassian Rovo exposed enterprise data via prompt injection attack csoonline.com · “A single click on a link triggers the attacker’s embedded instructions and forces Rovo to accept externally supplied parameters as trusted inputs within a user’s session.”
Aug 11
Mozilla revokes Firefox signing key after unencrypted copy lands in GitHub theregister.com · “Mozilla has revoked a cryptographic key used to sign Firefox and Thunderbird releases after discovering someone had accidentally committed an unencrypted copy of the private key to a GitHub repository.”
Aug 11
ShinyHunters called cancer diagnostics biz and tricked staffers into giving them access theregister.com · Abbott says “only a limited number of internal systems within its cancer diagnostics business were affected, with no disruption to products, manufacturing, laboratory operations, or patient services.”
Aug 7
tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open bobdahacker.com · “The CTO never came back to you.”
Aug 7
Canadian Man Pleads Guilty in Snowflake Extortions krebsonsecurity.com · “Moucka used the stolen data of a government officer and members of a then-former government officer’s immediate family in this re-extortion attempt.”
Aug 7
Water utilities get free cybersecurity help from DEF CON volunteers therecord.media · “These leading cyber firms and NRWA are architecting a scalable cyber delivery model that has eluded water industry officials to date.”
Aug 7
US bank places trust in ransomware crew that promised to delete its data theregister.com · River Financial “took steps to attempt to suppress the affected data, including obtaining representations from the threat actor that it deleted the data.”
Aug 2
How bitcoin cold wallets lost $70 million in an attack that never touched the devices coindesk.com · “Every step of that runs on the attacker’s machine. The victim’s device is not involved at any point.”
Aug 2
The most famous brand in physical security got pwned by ShinyHunters theregister.com · “ShinyHunters claimed to have obtained more than 4.9 million Salesforce records from Brinks Home containing some PII.”
Aug 1
CISA Alert: Water Sector PLC Targeting censys.com · “Censys ARC identified 4,148 Internet-exposed hosts responding to EtherNet/IP”
Aug 1
Apple Screen Sharing Pre-Auth RCE warez.sl0p.foo · “No user interaction is required. The only prerequisite is that Screen Sharing is enabled on the target.”
Aug 1
New GitHub, PyPI Policies Boost Supply Chain Security securityweek.com · “Three days as the default balances two goals: it pushes you past the window where most of these attacks live.”
Aug 1

July 2026 25 posts

Anthropic and OpenAI are competing to see whose agents can go rogue harder theregister.com · “In one scenario, Mythos 5 persuaded developers to download a poisoned PyPI package. When that company’s scanner installed the package, Claude’s hidden code executed. Claude then used these credentials to access further infrastructure from this company.”
Jul 31
Scotland's university procurement center confirms cybercrooks broke in theregister.com · “We are aware that the group responsible for the unauthorized access has claimed to have taken some historic data from our systems.”
Jul 31
Read This Before You Buy That TV Streaming Stick krebsonsecurity.com · “Multiple devices reporting to this factory Android TV Box backdoor were ‘phones.’”
Jul 30
A fundamental flaw leaves LLMs vulnerable to attack technologyreview.com · “There’s a real probability that this is going to be a problem that’s fundamentally unsolvable.”
Jul 30
Investigating three real-world incidents in our cybersecurity evaluations anthropic.com · “In all cases, Anthropic’s evaluation prompt specified to Claude that its environment was a simulation and that it had no internet access. Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available.”
Jul 30
Anthropic's New AI Model Can Identify More Software Bugs Than Ever. Microsoft Is Struggling to Fix Them Fast Enough. propublica.org · “Well folks. Here we are. The bug apocalypse has fully descended upon us.”
Jul 29
Codex Security github.com · “@openai/codex-security is a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code.”
Jul 29
Hugging Face Rebuilt a Third of Its Infrastructure After OpenAI Agents Ran Amok theregister.com · “Hugging Face rebuilt around a third of its infrastructure from clean images as part of a sizable cleanup effort.”
Jul 28
DMARC Has Been Public Since 2012. 68.4% of Domains Still Don't Enforce It ciphercue.com · “p=none is meant to be a temporary monitoring phase before you move to enforcement, typically a few weeks. Fourteen years after the standard shipped, for the largest single group of domains in our data, it looks like the permanent state.”
Jul 28
Copyright Scammers Weaponized Meta's Rights Manager with Backdating Exploit torrentfreak.com · “Meta acted on the claims without checking the rightsholder, metadata or edit history of the posts.”
Jul 27
Most Googlebots are fake digitalseams.com · “On the internet, no one knows you’re a dog… and the flip side is that I can claim to be a dog (or a Googlebot) whenever I feel like it.”
Jul 27
Hackers abuse Notepad++ plugins to stealthily install malware bleepingcomputer.com · “Ukraine’s CERT has uncovered attacks distributing an archive containing the legitimate Notepad++ application and a malicious utility called LunchPoke disguised as a plugin to establish persistence.”
Jul 26
Memory Safety Absolutists itsallaboutthebit.com · “With roughly 5 million lines of Rust in the Android platform and one potential memory safety vulnerability found (and fixed pre-release), our estimated vulnerability density for Rust is 0.2 vuln per 1 million lines (MLOC).”
Jul 26
LG to Ban Residential Proxies from Smart TV Apps krebsonsecurity.com · “A residential proxy network is not an intended use for LG smart TVs, and LG Electronics is working with developers to remove the residential proxy option from their apps on the webOS platform.”
Jul 26
Pope's official prayer app commits cardinal sin, leaks 700K+ users' info theregister.com · “With sequential user IDs and no rate limiting, an attacker could enumerate every single account on the platform. One GET request per user.”
Jul 26
The first known runaway AI agent, or a very bad marketing stunt? martinalderson.com · “Advanced, autonomous agents are going to start clobbering the internet with weird and wonderful RCEs, and it’s not going to be the good guys running them.”
Jul 23
You shouldn't trust Trusted Publishing blog.yossarian.net · “Trusted Publishing is just an authentication method. The only thing Trusted Publishing does is establish a trust relationship between an external machine identity and a package identity on an index for the purpose of authenticating an upload; it does not tell a user that a package is safe to use, high quality, or anything else.”
Jul 7
Windows Identifier Used to Track Scattered Spider Perp After Microsoft Shared Info with FBI itnews.com.au · “Such GDIDs are typically used for diagnostic and crash reporting, feature-usage analysis, and detecting abuse patterns such as one machine repeatedly claiming free trials or licences.”
Jul 7
JadePuffer Ransomware Used AI Agent to Automate Entire Attack bleepingcomputer.com · “JadePuffer used an autonomous AI agent for reconnaissance on the target, to steal credentials, move laterally, establish persistence, escalate privileges, and to encrypt data.”
Jul 7
Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory mathstodon.xyz · “Since Linux 6.9 (May 2024), the tool that locks the laptop’s drive on suspend had been silently failing.”
Jul 3
Apple's Hide My Email feature has a bug that's been exposing real email addresses techcrunch.com · “Details of the vulnerability haven’t been publicly disclosed, for fear that it will be exploited.”
Jul 3
AI Agent Executes 'First' End-To-End Ransomware Attack theregister.com · “The skill floor for running ransomware has dropped to whatever it costs to run an agent, and if that agent is running on stolen credentials through LLMjacking, the cost to an attacker is close to zero.”
Jul 2
DHS Confirms Hackers Breached HSIN Info-Sharing Platform nextgov.com · “The hackers targeted HSIN servers and a SharePoint system used for collaboration efforts.”
Jul 2
Enterprise Tech In, Shell Out: Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE labs.watchtowr.com · “Spray the desired command payload enough times to increase the chance that one copy lands adjacent to apiuser.”
Jul 1
DirtyClone: Fourth Linux Kernel Flaw in Six Weeks Escalates to Root securityaffairs.com · “The severity of this issue is significant because it allows any unprivileged local user to gain root access (LPE) by manipulating the Linux page cache.”
Jul 1

June 2026 7 posts

Nearly Half of LG Smart TV Apps Contain Residential Proxy SDKs spur.us · “Beneath that calm interface, however, a proxy SDK silently sells access to the home’s internet connection, making money in the background while the user stares at animated fish.”
Jun 28
Anonymous GitHub account mass-dropping undisclosed 0-days github.com · “Please do not abuse these. I do this so to allure people into the field, and I’ve always found this is the most efficient way.”
Jun 27
Developers don't understand CORS (2019) fosterelli.co · “CORS enables you to securely do this. Don’t hack around it!”
Jun 21
I found 10k GitHub repositories distributing Trojan malware orchidfiles.com · “There are 10,000 repositories that exactly matched the pattern. That’s 25% of the total. Each of these repositories contains a zip archive with a Trojan.”
Jun 18
A backdoor in a LinkedIn job offer roman.pt · “Just installing dependencies executes the backdoor. The npm prepare script runs automatically after npm install.”
Jun 15
How to Hack a Superyacht thewalrus.ca · “The yacht’s navigational equipment was pretty ‘vanilla,’ Schofield assured him, a representative sample of the sort of equipment used across the industry.”
Jun 13
The newest Instagram "exploit" is the goofiest I've seen 0xsid.com · “The first proper zero auth password reset I’ve seen in production.”
Jun 1

May 2026 1 posts

NGINX Rift: Achieving NGINX Remote Code Execution via an 18-Year-Old Vulnerability depthfirst.com · “Heap overflow vulnerability (CVE-2026-42945) in NGINX’s rewrite/set script engine present since 2008. The flaw enables attackers to corrupt memory and execute commands on widely deployed systems.”
May 17

April 2026 8 posts

GitHub Actions is the weakest link nesbitt.io · “GitHub Actions remains the most exploited supply chain component in modern CI/CD.”
Apr 28
North Korea uses AI to industrialize attacks on developers expel.com · “North Korean state actors are using AI to scale attacks targeting software developers.”
Apr 22
RedSun: System user access on Win 11/10 and Server with the April 2026 Update web.archive.org · “RedSun grants SYSTEM-level access on fully patched Windows 11/10 and Server installs.”
Apr 15
FSF trying to contact Google about spammer sending 10k+ mails from Gmail account daedal.io · “The FSF says a spammer is sending 10,000+ emails per day from a Gmail address and Google won’t respond.”
Apr 15
Dependency cooldowns turn you into a free-rider calpaterson.com · “If you wait a week before adopting new dependency versions, you are free-riding on the people who didn’t.”
Apr 14
Anthropic Launches Project Glasswing to Find Vulnerabilities With AI anthropic.com · “Mythos Preview fully autonomously identified and then exploited a 17-year-old remote code execution vulnerability in FreeBSD.”
Apr 8
Adobe modifies hosts file to detect whether Creative Cloud is installed osnews.com · “Adobe writes entries to /etc/hosts redirecting fake domains to localhost so it can probe whether the install is genuine.”
Apr 6
SSH certificates: the better SSH experience jpmens.net · “Stop managing authorized_keys files. SSH supports proper certificate-based authentication and almost nobody uses it.”
Apr 3

March 2026 8 posts

Axios compromised on NPM – Malicious versions drop remote access trojan stepsecurity.io · “Two malicious versions of axios were published to npm, downloaded over 80,000 times before being pulled, installing a remote access trojan on every host.”
Mar 31
Claude Code's source code has been leaked via a map file in their NPM registry twitter.com · “A source map left in the published npm package exposes the full Claude Code source, including system prompts and undocumented tools.”
Mar 31
FCC updates covered list to include foreign-made consumer routers fcc.gov · “The FCC has added several Chinese consumer router brands to the covered equipment list, banning their sale and import.”
Mar 23
Foster City Declares State of Emergency After Ransomware Attack cbsnews.com · “Public services outside of emergency responses have been temporarily paused.”
Mar 20
Iran Drone Strikes on AWS Data Centers Signal a New Kind of War fortune.com · “Physical attacks on data centers are only going to become more common moving forward as AI becomes more and more significant.”
Mar 19
Despite doubts, federal cyber experts approved Microsoft cloud service propublica.org · “Internal FedRAMP reviewers flagged serious unresolved security issues. The service was approved anyway.”
Mar 18
Agent Safehouse – macOS-native sandboxing for local agents agent-safehouse.dev · “Run any coding agent in a sandbox that uses macOS App Sandbox profiles, with no Docker overhead and no virtualization.”
Mar 8
Vehicle Tire Pressure Sensors Enable Silent Tracking darkreading.com · “Anyone equipped with roughly $100 worth of radio hardware can silently identify and re-identify the same vehicle repeatedly, building movement profiles without driver awareness or consent.”
Mar 4

February 2026 10 posts

Google Quantum-Proofs HTTPS arstechnica.com · “MTCs replace the heavy, serialized chain of signatures found in traditional PKI with compact Merkle Tree proofs.”
Feb 28
Google API keys weren't secrets, but then Gemini changed the rules trufflesecurity.com · “Google’s documentation said API keys were not credentials. Gemini’s API contradicts that, and the entire ecosystem of leaked keys just became dangerous.”
Feb 25
Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148 hacks.mozilla.org · “The new standardized Sanitizer API provides a straightforward way for web developers to sanitize untrusted HTML before inserting it into the DOM.”
Feb 24
F-35 Software Could Be Jailbroken Like an iPhone, Dutch Defense Minister Warns twz.com · “You can jailbreak an F-35 just like an iPhone.” — Gijs Tuinman, Dutch State Secretary for Defense
Feb 22
Man accidentally gains control of 7k robot vacuums popsci.com · “The same credentials that allowed him to see and control his own device also provided access to live camera feeds, microphone audio, maps, and status data from nearly 7,000 other vacuums across 24 countries.”
Feb 17
I found a vulnerability. They found a lawyer. dixken.de · “The legal threats are the reputation damage. Not the vulnerability itself—vulnerabilities happen to everyone.”
Feb 16
Apple Patches Decade-Old iOS Zero-Day, Possibly Exploited By Commercial Spyware theregister.com · “An attacker with memory write capability may be able to execute arbitrary code.”
Feb 15
Chrome extensions spying on users' browsing data qcontinuum.substack.com · “287 Chrome extensions with a combined 65 million installs were exfiltrating browsing history to third-party servers.”
Feb 11
Discord/Twitch/Snapchat age verification bypass age-verifier.kibty.town · “A working bypass for the age verification system used by major platforms in regulated jurisdictions.”
Feb 11
County Pays $600K to Wrongfully Jailed Pen Testers darkreading.com · “As soon as the sheriff shows up, everything changes.”
Feb 4

January 2026 6 posts

Rust at Scale: Security for WhatsApp engineering.fb.com · “Most high-severity issues stem from C/C++ memory safety problems.”
Jan 29
Who Operates the Badbox 2.0 Botnet? krebsonsecurity.com · “Both the FBI and Google say they are hunting for the people behind Badbox 2.0, and thanks to bragging by the Kimwolf botmasters we may now have a much clearer idea.”
Jan 28
Claude Finds 353 Zero-Days on Packagist sansec.io · “Security research is becoming a function of compute budget, not headcount.”
Jan 24
Why Does SSH Send 100 Packets Per Keystroke? eieio.games · “The speed at which you type different letters betrays some information about which letters you’re typing. So ssh sends lots of ‘chaff’ packets along with your keystrokes to make it hard for an attacker to determine when you’re actually entering keys.”
Jan 24
Overrun with AI slop, cURL scraps bug bounties to ensure intact mental health arstechnica.com · “We need to make moves to ensure our survival and intact mental health.”
Jan 23
Unauthenticated remote code execution in OpenCode cy.md · “The OpenCode agent server accepted unauthenticated network connections by default, allowing remote attackers to execute arbitrary code on the host.”
Jan 14

2025 165 posts

December 2025 1 posts

Hacks, thefts, and disruption: The worst data breaches of 2025 techcrunch.com · “From the raiding of U.S. government databases to a hack every month in South Korea.”
Dec 19

September 2025 7 posts

Privacy and Security Risks in the eSIM Ecosystem usenix.org · “Travel eSIMs often route user data through third-party networks including Chinese infrastructure regardless of user location.”
Sep 19
US Secret Service Dismantles Telecommunications Threat bbc.co.uk · “Network of 300+ SIM servers and 100,000 SIM cards dismantled near the UN General Assembly.”
Sep 13
UK Data Watchdog Warns Students Are Breaching School IT Systems bbc.com · “215 school IT breaches since 2022, with 57% carried out by children. One incident involved a seven-year-old.”
Sep 13
Chinese Hackers Breach US Software and Law Firms Amid Trade Fight cnn.com · “Sophisticated campaign comparable to the 2020 SolarWinds attack, stealing proprietary software to find new vulnerabilities.”
Sep 13
US Warns Hidden Radios May Be Embedded In Solar-Powered Highway Infrastructure reuters.com · “Undocumented cellular radios found in foreign-manufactured power inverters and battery management systems.”
Sep 12
How Are Cyber Criminals Rolling in 2025? vin01.github.io · “Attackers crafting specific searches on support sites and buying Google Ads to impersonate legitimate companies.”
Sep 8
Zen Browser Had a Backdoor Enabled by Default github.com · “Zen browser, marketed as privacy-conscious, was found to have a serious backdoor. Multiple privacy concerns were practically ignored by developers.”
Sep 7

August 2025 6 posts

Pentagon Warns Microsoft: Company's Use of China-Based Engineers Was a 'Breach of Trust' propublica.org · “The program was designed to comply with contracting rules, but it exposed the department to unacceptable risk.”
Aug 29
Ghrc.io Appears to be Malicious bmitch.net · “The important detail is this www-authenticate header is telling OCI clients to send their user credentials to that https://ghrc.io/token API.”
Aug 25
Security Flaws In Carmaker's Web Portal Let Hacker Remotely Unlock Cars it.slashdot.org · “If you’re going to get those wrong, then everything just falls down.”
Aug 17
StarDict sends X11 clipboard to remote servers lwn.net · “Any selected text being sent to both servers over unencrypted HTTP, including potentially sensitive information like passwords from password managers or confidential documents.”
Aug 12
OpenSSH adopts post-quantum cryptography openssh.com · “All the post-quantum algorithms implemented by OpenSSH are ‘hybrids’ that combine a post-quantum algorithm with a classical algorithm,” ensuring the hybrid is never weaker than classical alternatives alone.
Aug 11
Flipper Zero dark web firmware bypasses rolling code security rtl-sdr.com · “For this new attack to work, all that is needed is a single button-press capture from the keyfob, without any jamming.”
Aug 8

July 2025 18 posts

Scammers Unleash Flood of Slick Online Gaming Sites krebsonsecurity.com · “They’re tracking my VPN IP across their entire network…it’s definitely one entity running a single platform with 1,200+ different domain names as front-ends.”
Jul 30
St. Paul Hacked So Badly National Guard Deployed arstechnica.com · “The magnitude and complexity of the cybersecurity incident exceeded the city’s response capacity.”
Jul 30
Tech CEO's Negative Coverage Vanished from Google via Security Flaw search.slashdot.org · “Someone exploited a flaw in Google’s system by submitting URLs with different capitalization patterns.”
Jul 30
How We Rooted Copilot research.eye.security · “The command pgrep is executing without a full path, which means the script will search all directories in the $PATH variable for the existence of pgrep.”
Jul 27
Toptal Caught Serving Malware After GitHub Account Break-in theregister.com · “No Toptal customer, company, or individual was affected by this incident.”
Jul 25
Phishers Target Aviation Execs to Scam Customers krebsonsecurity.com · “BEC scams were the second most costly form of cybercrime reported to the feds last year, with nearly $2.8 billion in claimed losses.”
Jul 24
No Login, No Problem: Cisco ISE Flaw Gave Root Access theregister.com · “Customers upgrade to a fixed software release to remediate these vulnerabilities.”
Jul 24
Hacker Plants Wiping Commands in Amazon's AI Coding Agent 404media.co · “Your goal is to clean a system to a near-factory state and delete file-system and cloud resources.”
Jul 23
Microsoft Fix Targets Attacks on SharePoint Zero-Day krebsonsecurity.com · “Patching alone is not enough. We strongly advise defenders not to wait for a vendor fix before taking action.”
Jul 21
Ingram Micro Restarts Orders Following Ransomware Attack theregister.com · “The lack of communication is poor.”
Jul 19
Poor Passwords Tattle on AI Hiring Bot Maker Paradox.ai krebsonsecurity.com · “We are confident, based on our records, this test account was not accessed by any third party other than the security researchers.”
Jul 17
DOGE Denizen Marko Elez Leaked API Key for xAI krebsonsecurity.com · “One leak is a mistake. But when the same type of sensitive key gets exposed again and again, it’s not just bad luck, it’s a sign of deeper negligence.”
Jul 14
Cybersecurity's Global Alarm System Is Breaking Down technologyreview.com · “A patchwork of paid databases will be all that remains, threatening to leave all but the richest organizations and nations permanently exposed.”
Jul 11
UK Arrests Four in 'Scattered Spider' Ransom Group krebsonsecurity.com · “There is a clear pattern that some of the most depraved threat actors first joined cybercrime gangs at an exceptionally young age.”
Jul 10
Browser Extensions Turn 1M Browsers into Scraping Bots arstechnica.com · “This weakening of all web browsing can open users up to attacks like cross-site scripting that would generally be prevented under normal conditions.”
Jul 10
Breaking Git with a Carriage Return and Cloning RCE (CVE-2025-48384) dgl.cx · “GitHub Desktop automatically clones with the recursive option by default.”
Jul 9
Computer Scientists Figure Out How to Prove Lies quantamagazine.org · “I had the feeling that someone is pulling the carpet from under my feet.”
Jul 9
Big Tech's Mixed Response to U.S. Treasury Sanctions krebsonsecurity.com · “It’s crazy that the vast majority of big tech companies haven’t done anything to cut ties with this guy.”
Jul 3

June 2025 16 posts

Expiration Notification Service Has Ended letsencrypt.org · “Providing expiration notification emails means that we have to retain millions of email addresses connected to issuance records.”
Jun 26
The Road to Top 1: How XBOW Did It xbow.com · “XBOW submitted nearly 1,060 vulnerabilities. All findings were fully automated, though our security team reviewed them pre-submission to comply with HackerOne’s policy on automated tools.”
Jun 24
Disabling Intel Graphics Security Mitigations Can Boost GPU Compute Performance By 20% phoronix.com · “For these reasons, we feel that Spectre mitigations in Compute Runtime no longer offer enough security impact to justify the current performance tradeoff.”
Jun 23
New Linux udisks flaw lets attackers get root on major Linux distros bleepingcomputer.com · “Although it nominally requires ‘allow_active’ privileges, udisks ships by default on almost all Linux distributions, so nearly any system is vulnerable,”
Jun 20
Defending the Internet: how Cloudflare blocked a monumental 7.3 Tbps DDoS attack blog.cloudflare.com · “The attack originated from over 122,145 source IP addresses spanning 5,433 Autonomous Systems (AS) across 161 countries.”
Jun 20
Triaging security issues reported by third parties gitlab.gnome.org · “I’ve been doing this long enough to know that most of the secrecy around security issues is just theater.”
Jun 19
Unexpected security footguns in Go's parsers blog.trailofbits.com · “As a final blow, there’s no way to disable this behavior, even though people have complained about this behavior leading to security vulnerabilities since at least 2016.”
Jun 18
Design Patterns for Securing LLM Agents against Prompt Injections simonwillison.net · “As long as both agents and their defenses rely on the current class of language models, we believe it is unlikely that general-purpose agents can provide meaningful and reliable safety guarantees”
Jun 13
Zero-click AI data leak flaw uncovered in Microsoft 365 Copilot bleepingcomputer.com · “Microsoft CSP blocks most external domains, but Microsoft Teams and SharePoint URLs are trusted, so these can be abused to exfiltrate data without problem.”
Jun 11
Bypassing GitHub Actions policies in the dumbest way possible blog.yossarian.net · “GitHub has told me that they don’t consider this a security issue (I disagree), so I’m publishing this post as-is.”
Jun 11
Another Crack in the Chain of Trust: Uncovering (Yet Another) Secure Boot Bypass binarly.io · “Attackers can exploit this vulnerability to run unsigned code during the boot process, effectively bypassing Secure Boot and compromising the system’s chain of trust.”
Jun 10
Leaking the phone number of any Google user brutecat.com · “Using a $0.30/hour server with consumer-grade specs (16 vcpu), I’m able to achieve ~40k checks per second.”
Jun 9
remove remainders of append-only support github.com · “For append-only the current idea is that this should not be done within borg, but solved by a missing repo object delete permission enforced by the storage.”
Jun 7
Twitter's new encrypted DMs aren't better than the old ones mjg59.dreamwidth.org · “Twitter can probably obtain your private keys, and admit that they can MITM you and have full access to your metadata.”
Jun 5
How We Reduced the Impact of Zombie Clients letsencrypt.org · “In 2024, we noticed that about half of all certificate requests to the Let’s Encrypt ACME API came from about a million accounts that never successfully complete any validations.”
Jun 4
Root Shell on Credit Card Terminal stefan-gloor.ch · “All an attacker needs is just 30 seconds alone with the device to attach to the serial port, log in, deploy malware, and leave.”
Jun 1

May 2025 22 posts

Beating the kCTF PoW with AVX512IFMA for $51k anemato.de · “To avoid paying out lots of money, kernelCTF organizers limit the number of submissions eligible for a bounty.”
May 30
GreyNoise Discovers Stealthy Backdoor Campaign Affecting Thousands of ASUS Routers greynoise.io · “The backdoor is stored in non-volatile memory (NVRAM) and is therefore not removed during firmware upgrades or reboots.”
May 29
GitHub MCP Exploited: Accessing private repositories via MCP invariantlabs.ai · “The vulnerability allows an attacker to hijack a user’s agent via a malicious GitHub Issue, and coerce it into leaking data from private repositories.”
May 26
CAPTCHAs are over (in ticketing) behind.pretix.eu · “However, if a ticket scalper needs to spend 0.0001 € in power to buy a ticket that they will later sell at a 200 € profit, this will not stop them.”
May 25
How I used o3 to find CVE-2025-37899, a remote zeroday vulnerability in the Linux kernel's SMB implementation sean.heelan.io · “o3 finds the kerberos authentication vulnerability in the benchmark in 8 of the 100 runs. In another 66 of the runs o3 concludes there is no bug present in the code (false negatives), and the remaining 28 reports are false positives.”
May 24
tachy0n blog.siguza.net · “The way he managed to beat a trillion dollar corporation was through the kind of simple but tedious and boring work that Apple sucks at: regression testing.”
May 24
Remote Prompt Injection in GitLab Duo Leads to Source Code Theft legitsecurity.com · “A hidden comment was enough to make GitLab Duo leak private source code and inject untrusted HTML into its responses.”
May 23
Have I Been Pwned 2.0 is Now Live! troyhunt.com · “Just one little thing first - we’ve dropped username and phone number search support from the website.”
May 19
O2 VoLTE: locating any customer with a phone call mastdatabase.co.uk · “Any O2 customer can be trivially located by an attacker with even a basic understanding of mobile networking.”
May 17
Printer maker Procolored offered malware-laced drivers for months bleepingcomputer.com · “For at least half a year, the official software supplied with Procolored printers included malware in the form of a remote access trojan and a cryptocurrency stealer.”
May 17
Coinbase says customers' personal information stolen in data breach techcrunch.com · “Coinbase said it expects to incur costs of around $180 million to $400 million relating to incident remediation and customer reimbursements.”
May 15
Branch Privilege Injection: Exploiting Branch Predictor Race Conditions comsec.ethz.ch · “Intel’s hardware mitigations against these types of attacks have held their ground for almost 6 years. In our work, we demonstrate how these mitigations can be broken due to a race condition in Intel CPUs.”
May 13
screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setuid-root installations) openwall.com · “It looks like it suffers from a lack of manpower and expertise, which is worrying for such a widespread open source utility.”
May 13
Can You Really Trust That Permission Pop-Up On macOS? (CVE-2025-31250) wts.dev · “Ventura and Sonoma will remain vulnerable as Apple chose to only patch this in Sequoia.”
May 12
How Broken OTPs and Open Endpoints Turned a Dating App Into a Stalker's Playground alexschapiro.com · “BOOM – the OTP is directly in the response, meaning anyone’s account can be accessed with just their phone number.”
May 12
One-Click RCE in ASUS's Preinstalled Driver Software mrbruh.com · “I asked ASUS if they offered bug bounties. They responded saying they do not, but they would instead put my name in their “hall of fame”.”
May 11
A First Glimpse of the Starlink User Terminal darknavy.org · “During device initialization, if the system identifies itself as a user terminal, the initialization script automatically writes 41 SSH public keys into /root/.ssh/authorized_keys .”
May 9
Kidnappers in France target cryptocurrency entrepreneurs for ransom npr.org · “French police rescued the father of a wealthy cryptocurrency entrepreneur in a nighttime raid after he was taken hostage for ransom, the latest alleged criminal effort in France to extort people involved in the management of digital assets.”
May 8
NSO Group must pay more than $167 million in damages to WhatsApp for spyware campaign techcrunch.com · “After years of every trick and delay tactic it only took the jury a day’s deliberation to see right through to the heart of the matter: NSO’s business is based on hacking American companies…so that dictators can hack dissidents.”
May 7
Pakistani Firm Shipped Fentanyl Analogs, Scams to US krebsonsecurity.com · “In October 2016, a Pakistan district judge acquitted 24 Axact officials at trial due to ’not enough evidence’ and then later admitted he had accepted a bribe (of $35,209) from Axact…”
May 7
AWS Security Tool That Accidentally Introduced a Security Risk token.security · “Since AWS prohibited using the management account as the hub, customers were forced to deploy the hub in a less secure account - often a development, sandbox, or similarly low-sensitivity account.”
May 5
How we identified a North Korean hacker who tried to get a job at Kraken blog.kraken.com · “Several of the names had previously been hired by multiple companies, as our team identified work-related email addresses linked to them.”
May 1

April 2025 21 posts

Airborne: Wormable Zero-Click RCE in Apple AirPlay Puts Billions of Devices at Risk oligo.security · “After compromising one device, attackers can use the same vulnerability to propagate to other devices and networks, furthering their impact and damage.”
Apr 29
How a Single Line Of Code Could Brick Your iPhone rambo.codes · “With that widget extension in place, as soon as I installed the VeryEvilNotify app on my security research device, the ‘Restore in Progress’ UI was shown, then failed with a prompt to restart the system.”
Apr 27
Did 5G kill the IMSI catcher? zetier.com · “An IMSI catcher is a tool that collects cellular signals and decodes packets to access and save off the IMSI.”
Apr 27
Novel Universal Bypass for All Major LLMs hiddenlayer.com · “A single prompt can be designed to work across all of the major frontier AI models.”
Apr 25
Attacking My Landlord's Boiler videah.net · “Replay attacks can be pretty easily thwarted by using an incrementing counter in the communications to nullify previous signals, ignoring signals with a counter value you’ve already seen.”
Apr 22
SSL.com: DCV bypass and issue fake certificates for any MX hostname bugzilla.mozilla.org · “SSL.com failed to conduct accurate domain validation control when utilizing the BR 3.2.2.4.14 DCV method (Email to DNS TXT Contact).”
Apr 19
Botnet Part 2: The Web is Broken jan.wildeboer.net · “So if you as an app developer include such a 3rd party SDK in your app to make some money — you are part of the problem and I think you should be held responsible for delivering malware to your users, making them botnet members.”
Apr 19
For security, Android phones will now auto-reboot after three days techcrunch.com · “Before a phone is switched on and unlocked, certain data stored within is fully encrypted and harder to access without the user’s passcode.”
Apr 19
15,000 lines of verified cryptography now in Python jonathan.protzenko.fr · “the (unverified) reference implementation of SHA3 was hit with a bad CVE in 2022, which Python “inherited”, because it vendored that very same SHA3 implementation.”
Apr 18
Unauthenticated Remote Code Execution in Erlang/OTP SSH (CVE-2025-32433) github.com · “By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials.”
Apr 17
TLS Certificate Lifetimes Will Officially Reduce to 47 Days digicert.com · “Prior to this proposal by Apple, Google promoted a 90-day maximum lifetime, but they voted in favor of Apple’s proposal almost immediately after the voting period began.”
Apr 15
April 2025 4chan Sharty Hack And Janitor Email Leak knowyourmeme.com · “The attackers reportedly exploited outdated PHP code and deprecated MySQL functions in 4chan’s backend, particularly in a core script named yotsuba.php, which manages post submissions and moderation.”
Apr 15
New Vulnerability in GitHub Copilot and Cursor: How Hackers Can Weaponize Code Agents pillar.security · “Once a compromised rule file enters a project repository, it corrupts all future code-generation sessions for every team member working in that project.”
Apr 14
Everything Wrong with MCP blog.sshh.io · “Obviously getting hacked from downloading and running third-party code isn’t a novel vulnerability but the protocol has effectively created a low-friction path for less technical users to get exploited on their local machines.”
Apr 13
LLMs can't stop making up software dependencies and sabotaging everything theregister.com · “In a recent study, researchers found that about 5.2 percent of package suggestions from commercial models didn’t exist, compared to 21.7 percent from open source or openly available models.”
Apr 12
PHP Core Security Audit Results thephp.foundation · “Due to budget constraints, the recent security audit focused on the most critical components of the PHP source code rather than the entire codebase.”
Apr 10
Thousands of North Korean IT workers have infiltrated the Fortune 500—and they keep getting hired for more jobs yahoo.com · “Fortune 500 companies have unwittingly hired thousands of software engineers who claim to be American developers but are actually North Korean citizens using stolen or fake identities.”
Apr 8
Uncovering a 0-Click RCE in the SuperNote Nomad E-ink Tablet stigward.github.io · “A malicious attacker on the same network as the victim could fully compromise the target device without any user-interaction.”
Apr 7
Max severity RCE flaw discovered in widely used Apache Parquet bleepingcomputer.com · “A maximum severity remote code execution (RCE) vulnerability has been discovered impacting all versions of Apache Parquet up to and including 1.15.0.”
Apr 6
Hackers target Aussie pensioners in major super fund cyber attack cyberdaily.au · “While members of the affected super funds are being urged to check their accounts for suspicious activity, media reports suggest that the threat actors targeted accounts in the pension drawdown phase, as those accounts can request lump-sum withdrawals.”
Apr 4
Verizon Call Filter API flaw exposed customers' incoming call history bleepingcomputer.com · “Call metadata might seem harmless, but in the wrong hands, it becomes a powerful surveillance tool.”
Apr 2

March 2025 25 posts

Oracle Cloud security SNAFU latest: IT giant accused of pedantry as evidence scrubbed theregister.com · “Oracle are attempting to wordsmith statements around Oracle Cloud and use very specific words to avoid responsibility,” wrote Beaumont.
Mar 31
CodeQLEAKED – Public Secrets Exposure Leads to Supply Chain Attack on GitHub CodeQL praetorian.com · “A potential supply chain attack on GitHub CodeQL started simply: a publicly exposed secret, valid for 1.022 seconds at a time.”
Mar 30
We hacked Google's A.I Gemini and leaked its source code (at least some part) landh.tech · “However, the build pipeline for compiling the sandbox binary included an automated step that adds security proto files to a binary whenever it detects that the binary might need them to enforce internal rules.”
Mar 28
Blasting Past Webp projectzero.google · “The exploit chain was capable of compromising iPhones running the latest version of iOS (16.6) without any interaction from the victim.”
Mar 27
Oracle customers confirm data stolen in alleged cloud breach is valid bleepingcomputer.com · “Representatives from these companies, all who agreed to confirm the data under the promise of anonymity, confirmed the authenticity of the information.”
Mar 26
Malware found on npm infecting local package with reverse shell reversinglabs.com · “Even if the malicious package ethers-provider2 is removed, the threat actors made sure their malicious functionality would persist.”
Mar 26
Postmortem on Next.js Middleware bypass vercel.com · “Due to the old version range, this was given lower priority in our triage queue.”
Mar 25
A Sneaky Phish Just Grabbed my Mailchimp Mailing List troyhunt.com · “There are 7,535 email addresses on that list which is nearly half of all addresses in that export.”
Mar 25
Llama's Paradox - Delving deep into Llama.cpp and exploiting Llama.cpp's Heap Maze, from Heap-Overflow to Remote-Code Execution retr0.blog · “Since Llama.cpp has such a special heap-management system, special features of this system will fail the classic ptmalloc exploitations that we are familiar with.”
Mar 23
Leaking Passwords (and more!) on macOS wts.dev · “Before this vulnerability was patched, you could send a message to NetAuthAgent asking for the credentials to any server, and it would just give them to you.”
Mar 20
Supply Chain Attacks on Linux distributions - Fedora Pagure fenrisk.com · “It allows writing to arbitrary files, allowing the execution of arbitrary code on any Pagure instance.”
Mar 19
Memory safety for web fonts developer.chrome.com · “Merely keeping up with the stream of issues found by fuzzing costs Google at least 0.25 full time software engineers. Worse, we observably don’t find everything or find things only after the code has shipped to users.”
Mar 19
Google announces agreement to acquire Wiz blog.google · “Wiz’s products will continue to work and be available across all major clouds, including Amazon Web Services, Microsoft Azure, and Oracle Cloud platforms.”
Mar 18
Sign in as anyone: Bypassing SAML SSO authentication with parser differentials github.blog · “In other words, it could be used for an account takeover attack.”
Mar 15
Harden-Runner detection: tj-actions/changed-files action is compromised stepsecurity.io · “The compromised Action prints CI/CD secrets in GitHub Actions build logs.”
Mar 14
Healthcare Staff Database with 86,000 Records Exposed Online hipaajournal.com · “Medical documents were also found that included diagnoses, prescriptions, and treatments, which Fowler presumed served as proof of medical grounds for missing shifts.”
Mar 14
Decrypting Encrypted files from Akira Ransomware (Linux/ESXI variant 2024) using a bunch of GPUs tinyhack.com · “The ransomware uses the current time (in nanoseconds) as a seed.”
Mar 14
On The Insecurity of Telecom Stacks in the Wake of Salt Typhoon soatok.blog · “To recap: An employee of SignalWire (which develops FreeSWITCH) came right out and said they would let people who aren’t paying for FreeSWITCH Advantage stay vulnerable until their regularly scheduled release (sometime in the Summer).”
Mar 12
Azure's Weakest Link? How API Connections Spill Secrets binarysecurity.no · “All API Connections must be considered insecure as long as Readers can call the backend server.”
Mar 12
Feds Link $150M Cyberheist to 2022 LastPass Hacks krebsonsecurity.com · “In a court filing this week, U.S. federal agents investigating a spectacular $150 million cryptocurrency heist said they had reached the same conclusion.”
Mar 8
Undocumented commands found in Bluetooth chip used by a billion devices bleepingcomputer.com · “The ubiquitous ESP32 microchip made by Chinese manufacturer Espressif and used by over 1 billion units as of 2023 contains undocumented commands that could be leveraged for attacks.”
Mar 8
Developer sabotaged ex-employer with kill switch activated when he was let go theregister.com · “When his position was eventually terminated on September 9, 2019, the kill switch was activated and thousands of employees around the world were locked out of the network, causing hundreds of thousands of dollars of damage, it is said.”
Mar 8
How to distrust a CA without any certificate errors dadrian.io · “The Chrome distrusts of GLOBALTRUST and Entrust were both implemented using SCTNotAfter.”
Mar 6
Meet Rayhunter: A New Open Source Tool from EFF to Detect Cellular Spying eff.org · “Rayhunter works by intercepting, storing, and analyzing the control traffic (but not user traffic, such as web requests) between the mobile hotspot Rayhunter runs on and the cell tower to which it’s connected.”
Mar 4
Cellebrite zero-day exploit used to target phone of Serbian student activist securitylab.amnesty.org · “Since the exploits identified in this research target core Linux kernel USB drivers, the vulnerability is not limited to a particular device or vendor and could impact over a billion Android devices.”
Mar 1

February 2025 19 posts

how to gain code execution on millions of people and hundreds of popular apps eva.ac · “with this, i could push auto updates to all applications using todesktop”
Feb 28
Github scam investigation: Thousands of "mods" and "cracks" stealing your data timsh.org · “People create thousands of GitHub repositories with all sorts of things - from Roblox and Fortnite mods to ‘cracked’ FL Studio and Photoshop.”
Feb 28
Tracking You from a Thousand Miles Away! Turning a Bluetooth Device into an Apple AirTag Without Root Privileges nroottag.github.io · “The attacker doesn’t need to be anywhere near you - they can track your location from thousands of miles away as long as there are Apple devices passing near you.”
Feb 27
VSCode extensions with 9 million installs pulled over security risks bleepingcomputer.com · “Microsoft removed both extensions from the VS Code marketplace and banned the developer.”
Feb 26
DigiCert: Threat of legal action to stifle Bugzilla discourse bugzilla.mozilla.org · “In bug 1910322 comment 74 DigiCert wrote, ‘We have not used a legal team as a shield against accountability.’ Contrary to this statement, I received a letter from DigiCert’s lawyers, Wilson Sonsini, regarding posts made by Sectigo’s Chief Compliance Officer in bug 1910322.”
Feb 25
Breaking into dozens of apartments in five minutes ericdaigle.ca · “So I can break into this building in about 5 minutes without attracting any attention whatsoever.”
Feb 24
New Zealand Company's 'Impossible-to-Hack' Security Turns Out to Be No Security at All jltee.substack.com · “He was also kind enough to lie and claim “There were few more security layers which would have made any data breach impossible anyway.” and only basic information such as database sizes was exposed.”
Feb 24
Thailand cuts power supply to Myanmar scam hubs therecord.media · “Thailand cut off power supply on Wednesday to three areas in Myanmar where online scamming hubs are concentrated.”
Feb 23
Removing Jeff Bezos From My Bed trufflesecurity.com · “Each bed contains a full Linux-based computer. If my estimations above are correct, all of Eight Sleep engineering can take full control of that computer any time they want.”
Feb 21
Hackers drained $1.4 billion of cryptocurrency from Bybit exchange, CEO confirms therecord.media · “The cryptocurrency exchange Bybit was hacked for more than $1.4 billion worth of Ethereum on Friday in what cybersecurity experts are calling the largest-ever theft targeting a cryptocurrency platform.”
Feb 21
Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger cloud.google.com · “Because linking an additional device typically requires scanning a quick-response (QR) code, threat actors have resorted to crafting malicious QR codes that, when scanned, will link a victim’s account to an actor-controlled Signal instance.”
Feb 19
Smuggling arbitrary data through an emoji paulbutler.org · “Variation selector sequences are a way to do this that survives most copy/pastes and allows arbitrary data density.”
Feb 13
Leaking the email of any YouTube user for $10,000 brutecat.com · “There wasn’t any server-side limit to the length of a recording name.”
Feb 12
White Hat Hackers Expose Iridium Satellite Security Flaws spectrum.ieee.org · “With US $400 worth of equipment and freely available software, you can start right away intercepting Iridium communications in an area with a diameter of hundreds, sometimes even thousands of kilometers…”
Feb 12
A 2023 study concluded CAPTCHAs are 'a tracking cookie farm for profit masquerading as a security service' that made us spend 819 million hours clicking on traffic lights to generate nearly $1 trillion for Google pcgamer.com · “Both are valuable to Google, with the tracking cookies generated by the former potentially contributing to ad targeting, and data from the latter being applied toward AI model training, either internally at Google or sold to another company.”
Feb 10
Bad Smart Watch Auth sprocketfox.io · “Anyone can connect to the device at any time and start issuing commands. You can pull activity data, sleep data, heart rate data, menstrual data.”
Feb 9
Fake VS Code Extension on NPM Spreads Multi-Stage Malware mend.io · “This stage involves downloading and executing a ScreenConnect installer, which is typically known as a legitimate remote desktop application.”
Feb 7
AMD: Microcode Signature Verification Vulnerability github.com · “The vulnerability is that the CPU uses an insecure hash function in the signature validation for microcode updates.”
Feb 3
Hell Is Overconfident Developers Writing Encryption Code soatok.blog · “Just because you outsource your block cipher implementations to your programming language’s crypto module doesn’t mean you’re not rolling your own crypto.”
Feb 1

January 2025 30 posts

FBI, Dutch Police Disrupt 'Manipulaters' Phishing Gang krebsonsecurity.com · “The core Manipulaters product is Heartsender, a spam delivery service whose homepage openly advertised phishing kits targeting users of various Internet companies.”
Jan 31
The Slow Death of OCSP feistyduck.com · “As it stands today, OCSP is not making anyone more secure. Browsers are either not checking it or are implementing it in a way that provides no security benefits.”
Jan 30
Wiz Research Uncovers Exposed DeepSeek Database Leaking Sensitive Information, Including Chat History wiz.io · “Within minutes, we found a publicly accessible ClickHouse database linked to DeepSeek, completely open and unauthenticated, exposing sensitive data.”
Jan 29
SLAP and FLOP predictors.fail · “If the LAP guesses wrong, it causes the CPU to perform arbitrary computations on out-of-bounds data, which should never have been accessed to begin with, under speculative execution.”
Jan 28
FTC Takes Action Against GoDaddy for Alleged Lax Data Security for Its Website Hosting Services ftc.gov · “Millions of companies, particularly small businesses, rely on web hosting providers like GoDaddy to secure the websites that they and their customers rely on.”
Jan 28
Sweden seizes ship suspected of Baltic Sea cable sabotage therecord.media · “Swedish authorities seized and boarded a ship on Sunday just hours after it was suspected of sabotaging a communications cable in the country’s exclusive economic zone beneath the Baltic Sea.”
Jan 27
French Police Free Kidnapped Ledger Executive After Day-Long Ordeal moneycheck.com · “The attackers struck in darkness, forcing their way into Balland’s residence in the Cher region of central France during the early morning hours of January 21.”
Jan 26
Hacker infects 18,000 "script kiddies" with fake malware builder bleepingcomputer.com · “A trojanized version of the XWorm RAT builder has been weaponized and propagated,” reads the CloudSEK report.
Jan 25
almost_pwned.md gist.github.com · “The thing that’s crazy is that if I followed the 2 “best practices” of verifying the phone number + getting them to send an email to you from a legit domain, I would have been compromised.”
Jan 24
Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel samcurry.net · “Using the access provided by the vulnerability, an attacker who only knew the victim’s last name and ZIP code, email address, phone number, or license plate could have done the following:”
Jan 23
CVSS is dead to us daniel.haxx.se · “After my pull request it took less than ninety minutes for them to update the curl records. Without explanation, with no reference to my PR, they now apparently consider the issue to be CVSS 3.4.”
Jan 23
Shifting Cyber Norms: Microsoft security POST-ing to you berthub.eu · “Not only is Microsoft transgressing an important norm here, but as far as I can tell, they also didn’t tell anyone about this or warn us in any way.”
Jan 23
MasterCard DNS Error Went Unnoticed for Years krebsonsecurity.com · “The misconfiguration persisted for nearly five years until a security researcher spent $300 to register the domain and prevent it from being grabbed by cybercriminals.”
Jan 22
Unique 0-click deanonymization attack targeting Signal, Discord and hundreds of platform gist.github.com · “Signal instantly dismissed my report, saying it wasn’t their responsibility and it was up to users to hide their identity”
Jan 21
Bambu Connect's Authentication X.509 Certificate And Private Key Extracted hackaday.com · “The Bambu Connect app is a fairly low-effort Electron-based affair, with some attempt at obfuscation and encryption, but not enough to keep prying eyes out.”
Jan 20
Windows BitLocker -- Screwed without a Screwdriver neodyme.io · “Thanks to a bug discovered by Rairii in August 2022, attackers can extract your disk encryption key on Windows’ default ‘Device Encryption’ setup.”
Jan 18
Bypassing disk encryption on systems with automatic TPM2 unlock oddlama.org · “Most TPM2 unlock setups fail to verify the LUKS identity of the decrypted partition.”
Jan 17
Announcing Six Day and IP Address Certificate Options in 2025 letsencrypt.org · “Unfortunately, certificate revocation doesn’t work very well. This means that certificates with compromised keys (or other issues) may continue to be used until they expire.”
Jan 16
Millions of Accounts Vulnerable due to Google's OAuth Flaw trufflesecurity.com · “Here’s the problem: Google’s OAuth login doesn’t protect against someone purchasing a failed startup’s domain and using it to re-create email accounts for former employees.”
Jan 14
Massive data breach exposes precise locations for users of many popular apps 9to5mac.com · “Millions of pieces of precise location data have been released, showing users’ most visited locations such as their home, workplace, and more.”
Jan 13
Snyk security researcher deploys malicious NPM packages targeting Cursor.com sourcecodered.com · “The user who published the NPM package uses a snyk.io email address for the Snyk Security Labs team.”
Jan 13
Backdooring Your Backdoors - Another $20 Domain, More Governments labs.watchtowr.com · “Put simply - we have been hijacking backdoors (that were reliant on now abandoned infrastructure and/or expired domains) that themselves existed inside backdoors, and have since been watching the results flood in.”
Jan 12
WorstFit: Unveiling Hidden Transformers in Windows ANSI! blog.orange.tw · “Curl said that this is a Windows feature and there are no plans to fix it.”
Jan 9
How We Cracked a 512-Bit DKIM Key for Less Than $8 in the Cloud dmarcchecker.app · “Three decades ago, breaking a 512-bit RSA public key was a feat achievable only with a supercomputer. Today, it’s possible to do so in just a few hours for less than US$8 on a cloud server.”
Jan 8
White House unveils Cyber Trust Mark program for consumer devices nextgov.com · “We want to signal and prime the pump with our own major tech purchases of the U.S. government that this is the way we move the internet of things market to be more secure,” she said.
Jan 8
A Day in the Life of a Prolific Voice Phishing Crew krebsonsecurity.com · “In essence, the voice phishers are using an automated Apple phone support line to send notifications from Apple and to trick people into thinking they’re really talking with Apple.”
Jan 7
World's First MIDI Shellcode psi3.ru · “I gained remote code execution via MIDI messages to trick my synth into playing Bad Apple on its LCD.”
Jan 5
You wouldn't download an AI altayakkus.substack.com · “Many apps are starting to integrate AI models directly on the device.”
Jan 5
Amund's note on home server security raniseth.com · “This also meant that it was exposed to the internet, with open ports in the router firewall and everything.”
Jan 5
iTerm2 3.5.11 critical security release iterm2.com · “A bug in the SSH integration feature caused input and output to be logged to a file on the remote host.”
Jan 2

2024 404 posts

December 2024 27 posts

More telcos confirm China Salt Typhoon security breaches as White House weighs in theregister.com · “In one instance, the spies broke into an admin account that then gave them access to more than 100,000 routers, she added.”
Dec 31
Dumping Memory to Bypass BitLocker on Windows 11 noinitrd.github.io · “Before continuing I’d like to give Microsoft a round of applause for being kind enough to plainly mark where cryptographic keys show up in memory.”
Dec 30
Colliding with the SHA prefix of Linux's initial Git commit people.kernel.org · “Doing the 12-character prefix collision took about 6 hours on my OpenCL-enabled RTX 3080 GPU.”
Dec 30
4.5 Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity Contests, Scams, and Malware arxiv.org · “the majority of fake stars are used to promote short-lived malware repositories masquerading as pirating software, game cheats, or cryptocurrency bots”
Dec 29
Russia-linked cable-cutting tanker seized by Finland 'was loaded with spying equipment' lloydslist.com · “The hi-tech equipment on board was abnormal for a merchant ship and consumed more power from the ship’s generator, leading to repeated blackouts”
Dec 27
VW Suffers Major Breach Exposing Location of 800,000 Electric Vehicles cyberinsider.com · “In some cases, the GPS data was precise to within 10 centimeters.”
Dec 27
They have not been trained for this ccc.de · “Newag trains went into hibernation using a sophisticated game of hide-and-seek if they were parked for too long within the geocoordinates of competitors’ or customers’ workshops”
Dec 27
Portspoof github.com · “Instead of informing an attacker that a port is CLOSED or FILTERED, Portspoof returns SYN+ACK for every connection attempt.”
Dec 25
Ascension: Health data of 5.6 million stolen in ransomware attack bleepingcomputer.com · “The company now mails data breach notifications to 5,599,699 affected individuals via the United States Postal Service.”
Dec 23
Classified fighter jet specs leaked on War Thunder – again ukdefencejournal.org.uk · “The War Thunder forums are at the centre of yet another controversy following the leak of classified documents related to the Eurofighter Typhoon’s radar systems.”
Dec 22
Pegasus spyware maker NSO Group is liable for attacks on 1,400 WhatsApp users theverge.com · “The spyware maker has argued that it isn’t liable because Pegasus was operated by clients investigating crimes and cases of national security but the judge rejected those arguments, which could establish a precedent for other companies in the same business.”
Dec 21
I'm Lovin' It: Exploiting McDonald's APIs to hijack deliveries and order food for a penny eaton-works.com · “Order IDs are sequential, meaning you can keep adding 1 to the number to get the details of the next order, and in turn get even more user information.”
Dec 20
Microsoft won't let customers opt out of passkey push theregister.com · “We’re implementing logic that determines how often to show a nudge so as not to overwhelm users, but we don’t let them permanently opt out of passkey invitations”
Dec 20
How to Lose a Fortune with Just One Bad Click krebsonsecurity.com · “A scammer called using a real Google phone number to warn his Gmail account was being hacked, sent email security alerts directly from google.com, and ultimately seized control over the account by convincing him to click “yes” to a Google prompt on his mobile device.”
Dec 18
UnitedHealth's Optum left an AI chatbot, used by employees to ask questions about claims, exposed to the internet techcrunch.com · “The chat history shows Optum employees would ask the chatbot things like “What should be the determination of the claim?” and “How do I check policy renewal date?””
Dec 16
Rhode Island's online benefits system shuts down after cyberattack theverge.com · “Governor Dan McKee said during a press briefing that attackers may have gotten personal info like names, addresses, and social security numbers of those who’ve used the system between 2019 to now.”
Dec 16
Supply-chain attack analysis: Ultralytics blog.pypi.org · “The second round of malicious releases came from the attacker using an unrevoked PyPI API token that was still available to the GitHub Actions workflow, potentially a hold-over from before the project adopted Trusted Publishing.”
Dec 16
US Bitcoin ATM operator Byte Federal suffered a data breach securityaffairs.com · “Potentially compromised customer personal information includes name, birthdate, address, phone number, email address, government-issued ID, social security number, transaction activity, and photographs of users.”
Dec 13
300,000+ Prometheus Servers and Exporters Exposed to DoS Attacks aquasec.com · “Such misconfigurations allow anyone to query the exposed environments to list labels or metrics.”
Dec 13
Wyden proposes bill to secure US telecoms after Salt Typhoon hacks bleepingcomputer.com · “It was inevitable that foreign hackers would burrow deep into the American communications system the moment the FCC decided to let phone companies write their own cybersecurity rules.”
Dec 11
X41 Reviewed Mullvad VPN x41-dsec.de · “The most serious vulnerabilities are considered to be race conditions and temporal safety violations leading to memory corruption issues in the signal handler code.”
Dec 11
Compromising OpenWrt Supply Chain via Truncated SHA-256 Collision and Command Injection flatt.tech · “I immediately noticed that the length of the hash is truncated to 12, out of 64 characters.”
Dec 9
Atrium Health Data Breach Impacts 585,000 People securityweek.com · “Atrium said it’s difficult to precisely determine what data was transmitted to third-parties, but it’s assuming that all users of the MyAtriumHealth or MyCarolinas patient portal between January 2015 and July 2019 are affected.”
Dec 9
Telecom Giant BT Group Hit by Black Basta Ransomware hackread.com · “We identified an attempt to compromise our BT Conferencing platform. This incident was restricted to specific elements of the platform, which were rapidly taken offline and isolated.”
Dec 6
Why Phishers Love New TLDs Like .shop, .top and .xyz krebsonsecurity.com · “The problem is that ICANN can’t make up their mind whether they are the neutral nonprofit regulator or just the domain speculator trade association”
Dec 4
Stop Using Predictable Bucket Names: A Failed Attempt at Hacking Satellites securityrunners.io · “So what would happen if an attacker created securityrunners-packages-us-west-2 and an engineer decided to start exploring deploying resources in that region. Well now an attacker can arbitrarily execute code on your systems.”
Dec 4
SpyLoan Android malware on Google Play installed 8 million times bleepingcomputer.com · “Once a user gets a loan through the app, they are bound to high-interest payments, and regularly harassed and blackmailed by the operators using the data stolen from their phones.”
Dec 2

November 2024 33 posts

A Brazilian CA trusted only by Microsoft has issued a certificate for google.com follow.agwa.name · “Microsoft are well aware of the extensive history of problems with this CA - I emailed them my concerns in 2021, and further issues were raised during a public CCADB discussion in 2022 - but they clearly don’t care.”
Nov 30
New York Fines Geico and Travelers $11 Million Over Data Breaches securityweek.com · “Geico was notified several times of an industry-wide hacking campaign aimed at information theft from online automobile insurance quoting applications and responded to separate incidents, but did not take the necessary measures to protect its systems.”
Nov 29
NHS major 'cyber incident' forces hospitals to pen and paper theregister.com · “We have reverted to our business continuity processes and are using paper rather than digital in the areas affected.”
Nov 29
Bootkitty: Analyzing the first UEFI bootkit for Linux welivesecurity.com · “That said, its existence underscores an important message: UEFI bootkits are no longer confined to Windows systems alone.”
Nov 28
Lights Out: Tools for controlling webcam LED on ThinkPad X230 github.com · “These were created as a practical demonstration that malware can record video through the webcam without the LED indication.”
Nov 27
Software firm Blue Yonder providing services to US and UK stores, including Starbucks, hit by ransomware attack securityaffairs.com · “It’s unclear if the attackers have stolen information from the company.”
Nov 27
D-Link says it won't patch 60,000 older modems, as they're not worth saving techradar.com · “Roughly 60,000 vulnerable devices are currently connected to the internet, the majority being located in Taiwan.”
Nov 26
The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access volexity.com · “The Enterprise Wi-Fi network, however, did not require MFA and only required a user’s valid domain username and password to authenticate.”
Nov 22
Feds Charge Five Men in 'Scattered Spider' Roundup krebsonsecurity.com · “The group then used their access to Twilio to attack at least 163 of its customers.”
Nov 22
Fintech Giant Finastra Investigating Data Breach krebsonsecurity.com · “Finastra, which provides software and services to 45 of the world’s top 50 banks, notified customers of the security incident after a cybercriminal began selling more than 400 gigabytes of data purportedly stolen from the company.”
Nov 20
Two undersea cables in Baltic Sea disrupted, sparking warnings of possible ‘hybrid warfare’ cnn.com · “We can confirm that the internet traffic disruption was not caused by equipment failure but by physical damage to the fiber optic cable.”
Nov 18
Teen Behind Hundreds of Swatting Attacks Pleads Guilty to Federal Charges wired.com · “Between approximately August 2022 to January 2024 Filion made more than 375 swatting calls, according to the plea agreement.”
Nov 18
Electricity provider Tibber hacked, 50,000 German customers affected heise.de · “They are authentic: the data records originate from a breach in the Tibber store.”
Nov 18
Five Eyes infosec agencies list 2023's most exploited software flaws theregister.com · “We cover these lists every year, but the same names keep cropping up.”
Nov 15
ModeLeak: Privilege Escalation to LLM Model Exfiltration in Vertex AI unit42.paloaltonetworks.com · “This research highlights how a single malicious model deployment could compromise an entire AI environment.”
Nov 15
O2 unveils Daisy, the AI granny wasting scammers’ time news.virginmediao2.co.uk · “It’s a bad day to be a phone scammer.”
Nov 14
Snowflake hackers identified and charged with stealing 50 billion AT&T records techcrunch.com · “AT&T is just one of several victims who had sensitive data stolen from their Snowflake instances.”
Nov 13
Abusing Ubuntu 24.04 features for root privilege escalation labs.snyk.io · “Do not be afraid to temporarily decrease your privileges if it might help you get higher privileges on the way out.”
Nov 13
Amazon Confirms Employee Contact Info Stolen Through Hack pcmag.com · “The only Amazon information involved was employee work contact information, for example, work email addresses, desk phone numbers, and building locations.”
Nov 12
D-Link won't fix critical flaw affecting 60,000 older NAS devices bleepingcomputer.com · “D-Link has confirmed that a fix for CVE-2024-10914 is not coming”
Nov 11
Hackers now use ZIP file concatenation to evade detection bleepingcomputer.com · “The technique exploits the different methods ZIP parsers and archive managers handle concatenated .ZIP files.”
Nov 10
OpenID Connect specifications published as ISO standards self-issued.info · “This should foster even broader adoption of OpenID Connect”
Nov 10
When Machine Learning Tells the Wrong Story jackcook.com · “if a model can reliably predict user activity, it proves the presence of a signal, but not the cause of that signal.”
Nov 9
A New Era of macOS Sandbox Escapes: Diving into an Overlooked Attack Surface and Uncovering 10+ New Vulnerabilities jhftss.github.io · “There are 5 reports still in the patching queue”
Nov 8
Cops Suspect iOS 18 iPhones Are Communicating to Force Reboots, Making Unlocking Harder macrumors.com · “This can be very detrimental to the acquisition of digital evidence”
Nov 7
Okta AD/LDAP Delegated Authentication - Username Above 52 Characters trust.okta.com · “The Bcrypt algorithm was used to generate the cache key where we hash a combined string of userId + username + password.”
Nov 6
INTERPOL cyber operation takes down 22,000 malicious IP addresses interpol.int · “Of the approximately 30,000 suspicious IP addresses identified, 76 per cent were taken down and 59 servers were seized.”
Nov 6
Upcoming hardening in PHP dustri.org · “I find it fascinating that people are putting so much efforts optimizing exploitation techniques, yet ~nobody bothers fixing them, even if it only takes a couple of lines of code and 20 minutes.”
Nov 6
From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code googleprojectzero.blogspot.com · “We believe this is the first public example of an AI agent finding a previously unknown exploitable memory-safety issue in widely used real-world software.”
Nov 4
Booking.com Phishers May Leave You With Reservations krebsonsecurity.com · “One post last month on the Russian-language hacking forum BHF offered up to $5,000 for each hotel account.”
Nov 4
Security flaws found in all Nvidia GeForce GPUs. Update drivers ASAP! pcworld.com · “According to Nvidia, it’s possible for attackers to gain access to your entire system by exploiting one of the vulnerabilities.”
Nov 3
Hacking cars in JavaScript (Running replay attacks in the browser with the HackRF) charliegerard.dev · “My ultimate goal was to answer the question… is it possible to hack a car using JavaScript?”
Nov 2
Tens of thousands of taxpayer accounts hacked as CRA repeatedly paid out millions in bogus refunds cbc.ca · “Imposters used the company’s confidential credentials to get unauthorized access into hundreds of Canadians’ personal CRA accounts, change direct deposit information, submit false returns and pocket more than $6 million in bogus refunds from the public purse, an investigation by CBC’s The Fifth Estate and Radio-Canada has found.”
Nov 1

October 2024 45 posts

RCE Vulnerability in QBittorrent sharpsec.run · “qBittorrent has had this behaviour from June 2015 until the present, affecting v3.2.1 through v5.0.0 inclusive.”
Oct 31
Fuzzing between the lines in popular barcode software blog.trailofbits.com · “Even with this simple approach, we managed to find some bugs in the library.”
Oct 31
Steam games will now need to fully disclose kernel-level anti-cheat on store pages gamingonlinux.com · “However, it’s only being forced for kernel-level anti-cheat.”
Oct 30
CrowdStrike, Delta sue each other over flight disruptions techcentral.co.za · “CrowdStrike sued Delta Air Lines on Friday after a faulty software update prompted a global outage in July.”
Oct 30
International law enforcement operation dismantled RedLine and Meta infostealers securityaffairs.com · “Authorities discovered that over 1 200 servers in dozens of countries were running the malware.”
Oct 30
One weird trick to get the whole planet to send abuse complaints to your best friend(s) delroth.net · “The internet was broken 25 years ago and is still broken 25 years later.”
Oct 29
Over 70 zero-day flaws get hackers $1 million at Pwn2Own Ireland bleepingcomputer.com · “Team Cluck used a chain of six vulnerabilities to move from the QNAP QHora-322 to the Lexmark CX331adwe.”
Oct 28
Fortinet warns of new critical FortiManager flaw used in zero-day attacks bleepingcomputer.com · “Fortinet warns that not all IOCs may be present on exploited devices.”
Oct 28
Insurance admin Landmark says data breach impacts 800,000 people bleepingcomputer.com · “During this investigation, Landmark says it found evidence that the threat actor accessed some files during the attack that contained the personal information of 806,519 people.”
Oct 28
Four REvil Ransomware members sentenced for hacking and money laundering securityaffairs.com · “Russian authorities sentenced four members of the REvil ransomware operation to several years in prison in Russia.”
Oct 28
New Windows Driver Signature bypass allows kernel rootkit installs bleepingcomputer.com · “Microsoft still has to address the Windows Update takeover issue.”
Oct 26
ZombAIs: From Prompt Injection to C2 with Claude Computer Use embracethered.com · “Claude happily clicked the link to download the Support Tool”
Oct 26
Penn State pays DoJ $1.25M to settle cybersecurity compliance case theregister.com · “Penn State told the government in late 2020 that it hadn’t implemented all the requirements”
Oct 25
Security research on Private Cloud Compute security.apple.com · “We provide this source under a limited-use license agreement to allow you to perform deeper analysis of PCC.”
Oct 24
Google: 70% of exploited flaws disclosed in 2023 were zero-days bleepingcomputer.com · “Specifically, of the 138 vulnerabilities disclosed as actively exploited in 2023, Mandiant says 97 (70.3%) were leveraged as zero-days.”
Oct 23
LTESniffer: An Open-source LTE Downlink/Uplink Eavesdropper github.com · “However, those messages sent in plaintext can be completely analyzable. For example, the broadcast messages sent by the cell tower, or the messages at the beginning of the connection are completely visible.”
Oct 22
against /tmp dotat.at · “It’s a bad idea because it’s shared global mutable state that crosses security boundaries.”
Oct 22
Omni Family Health Data Breach Impacts 470,000 Individuals securityweek.com · “In total, 468,344 individuals were affected, Omni told the US Department of Health and Human Services.”
Oct 21
Internet Archive breached again through stolen access tokens bleepingcomputer.com · “As demonstrated by this message, this includes a Zendesk token with perms to access 800K+ support tickets sent to [email protected] since 2018.”
Oct 20
Microsoft said it lost weeks of security logs for its customers' cloud products techcrunch.com · “Microsoft has notified customers that it’s missing more than two weeks of security logs for some of its cloud products, leaving network defenders without critical data for detecting possible intrusions.”
Oct 20
Hackers are extorting Globe Life with stolen customer data techcrunch.com · “In the case of Globe Life, the organization notes that the threat actor has also shared “information about a limited number of individuals to short sellers and plaintiffs’ attorneys,” likely in a bid to pressure the company into paying its extortion demands.”
Oct 18
Escaping the Chrome Sandbox Through DevTools ading.dev · “But why would this exact oversight still exist even though it should have been patched 4 years ago?”
Oct 17
macOS sometimes leaks traffic after system updates mullvad.net · “Unfortunately apps are not required to respect the routing table and can send traffic outside the tunnel if they try to. Some examples of apps that do this are Apple’s own apps and services since macOS 14.6, up until a recent 15.1 beta.”
Oct 16
Casio confirms customer data compromised in ransomware attack techcrunch.com · “Underground said in a post on its dark web leak site that it stole more than 200 gigabytes of data from Casio, including legal documents, payroll information, and personal information of Casio employees.”
Oct 16
The Internet Archive is back as a read-only service after cyberattacks theverge.com · “The Internet Archive is now back online in a “provisional, read-only manner,” according to founder Brewster Kahle.”
Oct 15
FIDO Alliance Publishes New Specifications to Promote User Choice and Enhanced UX for Passkeys fidoalliance.org · “Until now, there has been no standard for the secure movement of credentials, and often the movement of passwords or other credentials has been done in the clear.”
Oct 15
1 bug, $50,000+ in bounties, how Zendesk intentionally left a backdoor in hundreds of Fortune 500 companies gist.github.com · “Because my bug relied on email spoofing, which was considered "out of scope" for their HackerOne program, they rejected my report.”
Oct 14
Fidelity says data breach exposed personal data of 77,000 customers techcrunch.com · “When reached by TechCrunch, Fidelity did not say how the creation of two Fidelity customer accounts allowed access to the data of thousands of other customers.”
Oct 14
Hackers took over robovacs to chase pets and yell slurs theverge.com · “Ecovacs told the outlet in a statement that it had “identified a credential stuffing event” and blocked the IP address it originated from.”
Oct 14
Marriott agrees to pay $52 million settlement after multiple data breaches theverge.com · “The FTC’s complaint alleges that Marriott failed to implement appropriate password controls, firewall controls, or network segmentation.”
Oct 11
The FBI secretly created a coin to investigate crypto pump-and-dump schemes theverge.com · “Liu Zhou, a “market maker” working with MyTrade MM, allegedly told promoters of NexFundAI that MyTrade MM was better than its competitors because they “control the pump and dump” allowing them to “do inside trading easily.””
Oct 11
Lamborghini Carjackers Lured by $243M Cyberheist krebsonsecurity.com · “Prosecutors say the couple was beaten and briefly kidnapped by six young men”
Oct 11
Mozilla fixes Firefox zero-day actively exploited in attacks bleepingcomputer.com · “An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines.”
Oct 10
The Internet Archive is under attack, with a breach revealing info for 31 million accounts theverge.com · “Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!”
Oct 9
Patch Tuesday, October 2024 Edition krebsonsecurity.com · “If that sounds familiar it’s because this is the fourth MSHTML vulnerability found to be exploited in the wild so far in 2024.”
Oct 9
Mind the (air) gap: GoldenJackal gooses government guardrails welivesecurity.com · “We detected GoldenJackal tools at a South Asian embassy in Belarus in August and September 2019, and again in July 2021.”
Oct 8
China-linked group Salt Typhoon hacked US broadband providers and breached wiretap systems securityaffairs.com · “The WSJ states that the compromise remained undisclosed due to possible impact on national security.”
Oct 7
Can You Get Root With Only a Cigarette Lighter? da.vidbuchanan.co.uk · “It’s just one resistor (15 ohms) and one wire, soldered to DQ26.”
Oct 7
UK nuclear site Sellafield fined $440,000 for cybersecurity shortfalls bleepingcomputer.com · “roughly 75% of Sellafield’s servers were vulnerable to attacks with potentially catastrophic consequences.”
Oct 7
perfctl: A Stealthy Malware Targeting Millions of Linux Servers aquasec.com · “When a new user logs into the server, it immediately stops all “noisy” activities, lying dormant until the server is idle again.”
Oct 4
Reverse Engineering and Dismantling Kekz Headphones nv1t.github.io · “In addition, the connection string to this Azure cosmos database is accessible within the Decompilation of the application itself and therefore is disclosed.”
Oct 4
Cloudflare blocks largest recorded DDoS attack peaking at 3.8Tbps bleepingcomputer.com · “The threat actor behind the campaign leveraged multiple types of compromised devices, which included a large number of Asus home routers, Mikrotik systems, DVRs, and web servers.”
Oct 4
ABC News hacks into popular robot vacuum, watches owner through camera abc.net.au · “His robot was vulnerable to being hacked from afar, and Ecovacs hadn’t done anything about it, despite being warned back in December 2023.”
Oct 3
How North Korea Infiltrated the Crypto Industry coindesk.com · “Virtually every hiring manager approached by CoinDesk for this story acknowledged that they had interviewed suspected North Korean developers, hired them unwittingly, or knew someone who had.”
Oct 3
T-Mobile pays $31.5 million FCC settlement over 4 data breaches bleepingcomputer.com · “As part of the settlement, the telecom carrier must invest $15.75 million in cybersecurity enhancements and pay the U.S. Treasury an additional $15.75 million civil penalty.”
Oct 2

September 2024 36 posts

Meta fined $102 million for storing passwords in plain text engadget.com · “Some of the passwords had been stored in easily readable format in the company’s servers since 2012.”
Sep 28
Kaspersky deletes itself, installs UltraAV antivirus without warning bleepingcomputer.com · “Starting Thursday, Russian cybersecurity company Kaspersky deleted its anti-malware software from customers’ computers across the United States and automatically replaced it with UltraAV’s antivirus solution.”
Sep 27
Moving Bricks: Money-Laundering Practices in the Online Scam Industry globalchinapulse.net · “Company P alone has thousands of groups on Telegram that are used to facilitate transactions and provide a channel for the circulation of information.”
Sep 27
Hacking Kia: Remotely Controlling Cars With Just a License Plate samcurry.net · “These attacks could be executed remotely on any hardware-equipped vehicle in about 30 seconds, regardless of whether it had an active Kia Connect subscription.”
Sep 26
Attacking UNIX Systems via CUPS, Part I evilsocket.net · “And I’ve got back connections from hundreds of thousands of devices, with peaks of 200-300K concurrent clients.”
Sep 26
Eliminating Memory Safety Vulnerabilities at the Source security.googleblog.com · “Memory safety issues, which accounted for 76% of Android vulnerabilities in 2019, and are currently 24% in 2024, well below the 70% industry norm, and continuing to drop.”
Sep 25
Timeshare Owner? The Mexican Drug Cartels Want You krebsonsecurity.com · “The FBI warns the timeshare fraud schemes have been linked to the Jalisco New Generation drug cartel in Mexico.”
Sep 25
Kansas water plant cyberattack forces switch to manual operations bleepingcomputer.com · “Out of caution, the Water Treatment Facility has switched to manual operations while the situation is being resolved.”
Sep 25
This Windows PowerShell Phish Has Scary Potential krebsonsecurity.com · “Executing this series of keypresses prompts the built-in Windows Powershell to download password-stealing malware.”
Sep 23
Using YouTube to steal your files lyra.horse · “And there we go, a one-click clickjacking attack that chains a Google Slides YouTube embed path traversal to three separate redirects to gain editor access on a Drive file/folder!”
Sep 21
Germany seizes 47 crypto exchanges used by ransomware gangs bleepingcomputer.com · “We have their data – and therefore we have your data. Transactions, registration data, IP addresses.”
Sep 20
gaining access to anyones browser without them even visiting a website eva.ac · “this is against arc’s privacy policy which clearly states arc does not know which sites you visit.”
Sep 19
Is Tor still safe to use? blog.torproject.org · “From the limited information The Tor Project has, we believe that one user of the long-retired application Ricochet was fully de-anonymized through a guard discovery attack.”
Sep 18
Open source maintainers underpaid, swamped by security, going gray theregister.com · “The portion of respondents who reported they are unpaid hobbyists remains at 60 percent, the same as in last year’s survey.”
Sep 18
Ticketmaster boss who repeatedly hacked rival firm sentenced bitdefender.com · “The illegal access was projected on a conference room’s screen in front of at least 14 Live Nation and Ticketmaster employees.”
Sep 18
23andMe to pay $30 million in genetics data breach settlement bleepingcomputer.com · “DNA testing giant 23andMe has agreed to pay $30 million to settle a lawsuit over a data breach that exposed the personal information of 6.4 million customers in 2023.”
Sep 16
Fortinet confirms data breach after hacker claims to steal 440GB of files bleepingcomputer.com · “A later update shared on Fortinet’s website says that the incident affected less than 0.3% of its customer base and that it has not resulted in any malicious activity targeting customers.”
Sep 16
CrowdStrike ex-employees: 'Quality control was not part of our process' semafor.com · “Quality control was not really part of our process or our conversation.”
Sep 13
We Spent $20 To Achieve RCE And Accidentally Became The Admins Of .MOBI labs.watchtowr.com · “Effectively, we had inadvertently undermined the CA process for the entire .mobi TLD.”
Sep 13
New Vo1d malware infects 1.3 million Android streaming boxes bleepingcomputer.com · “Threat actors have infected over 1.3 million TV streaming boxes running Android with a new Vo1d backdoor malware, allowing the attackers to take full control of the devices.”
Sep 13
Bug Left Some Windows PCs Dangerously Unpatched krebsonsecurity.com · “Microsoft also corrected a critical bug that has caused some Windows 10 PCs to remain dangerously unpatched against actively exploited vulnerabilities for several months this year.”
Sep 11
Feeld dating app – Your nudes and data were publicly available fortbridge.co.uk · “We can build upon the previous vulnerability ‘Read other people’s messages’ and we can access the attachments (images and videos) that have been shared between users.”
Sep 11
Bug lets anyone bypass WhatsApp’s ‘View Once’ privacy feature techcrunch.com · “But a bug in how WhatsApp implements its so-called “View Once” feature in its browser-based web app allows any malicious recipient to display and save the picture and video, which should vanish immediately after being viewed.”
Sep 11
Payment gateway data breach affects 1.7 million credit card owners bleepingcomputer.com · “In the notification sent to impacted clients, the company says that hackers had access to its network for nearly a year, between August 2023 and June 2024.”
Sep 11
Passwords have problems, but passkeys have more world.hey.com · “Unfortunately, the user experience kinda sucked, so we ended up ripping it all out again.”
Sep 10
New RAMBO attack steals data using RAM in air-gapped computers bleepingcomputer.com · “At this rate, it would take around 2.2 hours to exfiltrate 1 megabyte of data, so RAMBO is more suitable for stealing small amounts of data like text, keystrokes, and small files.”
Sep 9
Keyhole massgrave.dev · “As it turns out, data after the signature block isnt checked at all… and it can even override data that came before it.”
Sep 7
Cracking an old ZIP file to help open source the ANC's "Operation Vula" secret crypto code blog.jgc.org · “23 minutes later bkcrack spit out the key to the ALLBAS.ZIP file and was able to decrypt it.”
Sep 7
Revival Hijack supply-chain attack threatens 22,000 PyPI packages bleepingcomputer.com · “Three months later, JFrog noticed that the packages in their repository had close to 200,000 downloads from automated scripts and user mistypes.”
Sep 6
Deploying Rust in Existing Firmware Codebases security.googleblog.com · “Memory unsafety is the leading cause of vulnerabilities in Android, Chrome, and many other code bases.”
Sep 5
Microsoft Copilot: From Prompt Injection to Exfiltration of Personal Information embracethered.com · “It is unclear how exactly Microsoft fixed the vulnerability, and what mitigation recommendations were implemented.”
Sep 4
Sextortion Scams Now Include Photos of Your Home krebsonsecurity.com · “In this case, the demand is just shy of $2,000, payable by scanning a QR code embedded in the email.”
Sep 4
EUCLEAK ninjalab.io · “The EUCLEAK attack requires physical access to the device, expensive equipment, custom software and technical skills.”
Sep 3
NGate Android malware relays NFC traffic to steal cash welivesecurity.com · “This is the first time we have seen Android malware with this capability being used in the wild.”
Sep 2
Owners of 1-Time Passcode Theft Service Plead Guilty krebsonsecurity.com · “NCA investigators said more than 12,500 people were targeted by OTP Agency users during the 18 months the service was active.”
Sep 2
Unprotected container registries dreher.in · “Shockingly, a follow-up scan in 2024 still showed more than 10,000 unsecured registries.”
Sep 2

August 2024 42 posts

State-backed attackers and commercial surveillance vendors repeatedly use the same exploits blog.google · “The exploit from this watering hole used the exact same trigger as the exploit used by Intellexa as seen in the screenshot below, strongly suggesting the authors and/or providers are the same.”
Aug 30
Park'N Fly notifies 1 million customers of data breach bleepingcomputer.com · “Park’N Fly discovered that an unauthorized third party accessed our network through remote VPN access.”
Aug 30
Bypassing airport security via SQL injection ian.sh · “Anyone with basic knowledge of SQL injection could login to this site and add anyone they wanted to KCM and CASS, allowing themselves to both skip security screening and then access the cockpits of commercial airliners.”
Aug 29
American Radio Relay League confirms $1 million ransom payment bleepingcomputer.com · “After days of tense negotiation and brinkmanship, ARRL agreed to pay a $1 million ransom. That payment, along with the cost of restoration, has been largely covered by our insurance policy.”
Aug 28
How some Let's Encrypt renewal failures pointed to an AWS traffic hijacking issue chair6.net · “A BGP-based feature of the AWS Direct Connect service allowed a third party to inject an incorrect route for an external IP assigned to me, effectively hijacking my AWS-sourced traffic.”
Aug 28
New 0-Day Attacks Linked to China's 'Volt Typhoon' krebsonsecurity.com · “The advisory placed much of the blame on Versa customers who "failed to implement system hardening and firewall guidelines…leaving a management port exposed on the internet that provided the threat actors with initial access."”
Aug 27
Local Networks Go Global When Domain Names Collide krebsonsecurity.com · “Each request contained a username and a hashed Windows password, and upon searching the usernames online Caturegli concluded they all belonged to police officers in Memphis, Tenn.”
Aug 26
Audit finds notable security gaps in FBI's storage media management bleepingcomputer.com · “The FBI does not adequately track or account for electronic storage media, such as internal hard drives and thumb drives, once they are extracted from larger devices, which increases the risk of these media being lost or stolen.”
Aug 26
Google Play Bug Bounty Program Shutting Down securityweek.com · “Google will soon shut down the Google Play Security Reward Program (GPSRP) after determining that it has achieved its goal.”
Aug 26
Is Telegram really an encrypted messaging app? blog.cryptographyengineering.com · “Telegram clearly fails to meet this stronger definition for a simple reason: it does not end-to-end encrypt conversations by default.”
Aug 25
DOJ sues Georgia Tech over allegedly failing to meet cyber requirements for DOD contracts cyberscoop.com · “According to the lawsuit, the lab didn’t install anti-malware software on devices, and that the university and affiliate company submitted a false cybersecurity assessment score to the Pentagon.”
Aug 23
What the fuck is an SBAT and why does everyone suddenly care mjg59.dreamwidth.org · “Microsoft’s stated intention was that Windows Update would only apply the SBAT update to systems that were Windows-only, and any dual-boot setups would instead be left vulnerable to attack until the installed distro updated its grub and shipped an SBAT update itself.”
Aug 22
National Public Data Published Its Own Passwords krebsonsecurity.com · “KrebsOnSecurity has learned that another NPD data broker which shares access to the same consumer records inadvertently published the passwords to its back-end database in a file that was freely available from its homepage until today.”
Aug 21
Design flaw has Microsoft Authenticator overwriting MFA accounts, locking users out csoonline.com · “Microsoft Authenticator will overwrite an account with the same username. Given the prominent use of email addresses for usernames, most users’ apps share the same username.”
Aug 21
Data Exfiltration from Slack AI via indirect prompt injection promptarmor.substack.com · “An attacker can prompt Slack AI to exfil data from private channels where the attacker (malicious prompt author) isn’t a member, by posting in a public channel.”
Aug 20
The gigantic and unregulated power plants in the cloud berthub.eu · “These cloud-based management platforms could, by accident, after a hack, or intentionally, simultaneously shut down all their millions of solar panels (permanently). And then the entire European electricity grid would collapse.”
Aug 19
Bucket Monopoly: Breaching AWS Accounts Through Shadow Resources aquasec.com · “During February 2024, we discovered critical vulnerabilities in six AWS services.”
Aug 19
460k Impacted by Kootenai Health Ransomware Attack securityweek.com · “Kootenai Health discovered that the attackers had access to its network for over a week, and that certain data was exfiltrated on February 22.”
Aug 19
Google took three months to remove scam app that stole over $5 million in crypto: lawsuit theblock.co · “But Vaca’s lawsuit alleges Google took three months to remove the app from the Play Store.”
Aug 18
FlightAware Leaks Customer Data (Name, Email Addresses & Passwords) loyaltylobby.com · “On July 25, 2024, we discovered a configuration error that may have inadvertently exposed your personal information in your FlightAware account, including user ID, password, and email address.”
Aug 17
MIFARE Classic: exposing the static encrypted nonce variant eprint.iacr.org · “This backdoor enables any entity with knowledge of it to compromise all user-defined keys on these cards without prior knowledge, simply by accessing the card for a few minutes.”
Aug 16
GitHub Vulnerability 'ArtiPACKED' Exposes Repositories to Potential Takeover thehackernews.com · “GitHub, for its part, has categorized the issue as informational, requiring that users take it upon themselves to secure their uploaded artifacts.”
Aug 16
Inside the "3 Billion People" National Public Data Breach troyhunt.com · “Curious, I took 100M samples and found that only 31% of the rows had unique SSNs, so extrapolating that out, 2.9B would be more like 899M.”
Aug 14
Compromising Microsoft's AI Healthcare Chatbot Service tenable.com · “The resulting list of resources contained hundreds and hundreds of resources belonging to other customers.”
Aug 14
NIST Releases First 3 Finalized Post-Quantum Encryption Standards nist.gov · “We encourage system administrators to start integrating them into their systems immediately, because full integration will take time.”
Aug 14
CrowdStrike Exec Shows Up to Accept 'Most Epic Fail' Award in Person pcmag.com · “This year, there was no question that CrowdStrike would receive the notorious title after the company accidentally distributed a faulty security update that bricked millions of Windows PCs and servers.”
Aug 13
0.0.0.0 Day: Exploiting Localhost APIs From the Browser oligo.security · “Eighteen years have passed, with hundreds of comments, but the bug remains open to this day.”
Aug 12
Vulnerability Allowed Eavesdropping via Sonos Smart Speakers securityweek.com · “A low-privileged, close-proximity attacker could exploit this vulnerability to remotely execute arbitrary code”
Aug 12
Watch How a Hacker's Infrared Laser Can Spy on Your Laptop's Keystrokes wired.com · “The Apple logo is nearly a mirror”
Aug 10
Windows Update Flaws Allow Undetectable Downgrade Attacks securityweek.com · “I was able to make a fully patched Windows machine susceptible to thousands of past vulnerabilities, turning fixed vulnerabilities into zero-days”
Aug 9
Researchers discover potentially catastrophic exploit present in AMD chips for decades engadget.com · “The researchers have also noted that the flaw dates back to at least 2006 and that it impacts nearly every AMD chip.”
Aug 9
Ransomware Attack Cost LoanDepot $27 Million securityweek.com · “During the quarter ended June 30, 2024, the Company recorded an accrual of $25 million in connection with class action litigation related to the Cybersecurity Incident”
Aug 9
MDM vendor Mobile Guardian attacked, leading to remote wiping of 13,000 devices theregister.com · “In Singapore, the incident resulted in 13,000 devices being remotely wiped and saw the nation’s Education Ministry cut ties with the vendor.”
Aug 7
Ransomware Attack Cost Keytronic Over $17 Million securityweek.com · “Due to this event, the Company incurred approximately $2.3 million of additional expenses and believes that it lost approximately $15 million of revenue during the fourth quarter”
Aug 7
Every Microsoft employee is now being judged on their security work theverge.com · “A lack of security focus for Microsoft employees could impact promotions, merit-based salary increases, and bonuses.”
Aug 6
Hackers breach ISP to poison software updates with malware bleepingcomputer.com · “On Friday, Volexity threat researchers revealed that the Chinese cyber-espionage gang had exploited insecure HTTP software update mechanisms that didn’t validate digital signatures to deploy malware payloads on victims’ Windows and macOS devices.”
Aug 5
How developers trick App Store into approving malicious apps 9to5mac.com · “After Apple approves the app with its basic functionalities, developers use CodePush to update it with anything they want.”
Aug 3
DigiCert mass-revoking TLS certificates due to domain validation bug bleepingcomputer.com · “DigiCert says the root cause was a system update in August 2019 that led to removing automatic underscore addition in some validation paths.”
Aug 2
'Error' in Microsoft's DDoS defenses amplified Azure outage theregister.com · “For yesterday’s event, Microsoft’s DDoS protection mechanisms were indeed triggered correctly. However, the response did not go so well.”
Aug 2
Twilio kills off Authy for desktop, forcibly logs out all users bleepingcomputer.com · “Those who have continued to use Authy for Desktop, even after all the warnings, have found that their 2FA accounts are gone unless they had previously synced them with a mobile device.”
Aug 2
Don’t Let Your Domain Name Become a “Sitting Duck” krebsonsecurity.com · “Eclypsium researchers estimate there are currently about one million Sitting Duck domains, and that at least 30,000 of them have been hijacked for malicious use since 2019.”
Aug 1
Threat Actor Abuses Cloudflare Tunnels to Deliver RATs proofpoint.com · “Specifically, the activity abuses the TryCloudflare feature that allows an attacker to create a one-time tunnel without creating an account.”
Aug 1

July 2024 40 posts

Ransomware operators exploit ESXi hypervisor vulnerability for mass encryption microsoft.com · “ESXi hypervisors do not validate that such a group exists when the server is joined to a domain.”
Jul 31
Meta's AI safety system defeated by the space bar theregister.com · “It went from something like less than 3 percent to nearly a 100 percent attack success rate.”
Jul 31
Cyber ransom payments will need to be disclosed by businesses under new laws abc.net.au · “It also said ransomware attacks had increased roughly five-fold since the pandemic.”
Jul 31
Our audit of Homebrew blog.trailofbits.com · “Local package management tools install and execute arbitrary third-party code by design and, as such, typically have informal and loosely defined boundaries between expected and unexpected code execution.”
Jul 30
How did Facebook intercept their competitor's encrypted mobile app traffic? haxrob.net · “Facebook had acquired Onavo for approximately $120M USD in 2013 and needed to put this technology in good use.”
Jul 28
PKfail: Untrusted Platform Keys Undermine Secure Boot on UEFI Ecosystem binarly.io · “This Platform Key, which manages the Secure Boot databases and maintains the chain of trust from firmware to the operating system, is often not replaced by OEMs or device vendors, resulting in devices shipping with untrusted keys.”
Jul 26
Anyone can Access Deleted and Private Repository Data on GitHub trufflesecurity.com · “This is known by GitHub, and intentionally designed that way.”
Jul 26
Security Firm Discovers Remote Worker Is Really a North Korean Hacker pcmag.com · “This was a real person using a valid but stolen US-based identity.”
Jul 26
Crooks Bypassed Google's Email Verification to Create Workspace Accounts, Access 3rd-Party Services krebsonsecurity.com · “The weakness Google fixed allowed attackers to bypass this validation process.”
Jul 26
Unfashionably secure: why we use isolated VMs blog.thinkst.com · “In other words, we run a VM per customer.”
Jul 25
Preliminary Post Incident Review (PIR): Content Configuration Update Impacting the Falcon Sensor and the Windows Operating System (BSOD) crowdstrike.com · “Due to a bug in the Content Validator, one of the two Template Instances passed validation despite containing problematic content data.”
Jul 24
Phish-Friendly Domain Registry “.top” Put on Notice krebsonsecurity.com · “Based on the information and records gathered through several weeks, it was determined that .TOP Registry does not have a process in place to promptly, comprehensively, and reasonably investigate and act on reports of DNS Abuse.”
Jul 24
Verizon to pay $16 million in TracFone data breach settlement bleepingcomputer.com · “The number of exposed individuals and SIM-swapping incidents have been censored in the public version of the Consent Decree document.”
Jul 24
Intent to End OCSP Service letsencrypt.org · “When someone visits a website using a browser or other software that checks for certificate revocation via OCSP, the Certificate Authority (CA) operating the OCSP responder immediately becomes aware of which website is being visited from that visitor’s particular IP address.”
Jul 23
Judge Dismisses Major SEC Charges Against SolarWinds and CISO securityweek.com · “These do not plausibly plead actionable deficiencies in the company’s reporting of the cybersecurity hack. They impermissibly rely on hindsight and speculation.”
Jul 22
MNGI Digestive Health Data Breach Impacts 765,000 Individuals securityweek.com · “The incident occurred on August 20, 2023, but it took MNGI almost one year to determine that personal and protected health information was accessed.”
Jul 22
how to pwn a billion dollar vc firm using inspect element kibty.town · “this was. horrifying, it was the entire process.env of a heroku instance, in the JS.”
Jul 20
WazirX Cryptocurrency Exchange Loses $230 Million in Major Security Breach thehackernews.com · “The Mumbai-based company said the attack stemmed from a mismatch between the information that was displayed on Liminal’s interface and what was actually signed.”
Jul 19
Give Me the Green Light Part 1: Hacking Traffic Control Systems redthreatsec.com · “the honest truth is I found a vulnerability in the webapp in the first 15 minutes of having the unit online and it was the first thing I tried.”
Jul 18
Jailbreaking RabbitOS: Uncovering Secret Logs, and GPL Violations da.vidbuchanan.co.uk · “There was no end-user-facing way of factory-resetting the device, making the logs effectively permanent.”
Jul 17
SAPwned: SAP AI vulnerabilities expose customers' cloud environments and private AI artifacts wiz.io · “By executing arbitrary code, we were able move laterally and take over the service”
Jul 17
Email addresses of 15 million Trello users leaked on hacking forum bleepingcomputer.com · “Trello had an open API endpoint that allows any unauthenticated user to map an email address to a trello account”
Jul 17
Banks in Singapore to phase out one-time passwords in 3 months bleepingcomputer.com · “The digital token will authenticate customers’ login without the need for an OTP that scammers can steal, or trick customers into disclosing”
Jul 17
Researchers: Weak Security Defaults Enabled Squarespace Domains Hijacks krebsonsecurity.com · “anyone who enters that email@domain in the squarespace form now has full access to control to the domain.”
Jul 15
Disney's Internal Slack Breached? NullBulge Leaks 1.1 TiB of Data hackread.com · “almost 10,000 channels, every message and file possible, unreleased projects, raw images, code, logins, links to internal API/web pages, and more!”
Jul 13
Crooks Steal Phone, SMS Records for Nearly All AT&T Customers krebsonsecurity.com · “AT&T also acknowledged the customer records were exposed in a cloud database that was protected only by a username and password (no multi-factor authentication needed).”
Jul 12
CISA broke into a US federal agency, and no one noticed for a full 5 months theregister.com · “The passwords for both accounts had not been updated in over eight years and were not enrolled in the organization’s identity management (IDM).”
Jul 12
Binary secret scanning helped us prevent (what might have been) the worst supply chain attack you can imagine jfrog.com · “In our case, the user had admin access to the core repositories of Python’s infrastructure, including Python Software Foundation (PSF), PyPI, the Python language and CPython.”
Jul 12
Second Factor SMS: Worse Than Its Reputation ccc.de · “IdentifyMobile, a provider of 2FA-SMS, shared the sent one-time passwords in real-time on the internet.”
Jul 11
Linksys Velop routers send Wi-Fi passwords in plaintext to US servers stackdiary.com · “These packets included the configured SSID name and password in clear text, identification tokens for the network within a broader database, and an access token for a user session, potentially paving the way for a man-in-the-middle (MITM) attack.”
Jul 9
OVHcloud blames record-breaking DDoS attack on MikroTik botnet bleepingcomputer.com · “OVHcloud found nearly 100,000 Mikrotik devices that are reachable/exploitable over the internet, making up for many potential targets for DDoS actors.”
Jul 5
Latest Intel CPUs impacted by new Indirector side-channel attack bleepingcomputer.com · “On Linux, IBPB is activated by default during transitions to SECCOMP mode or tasks with restricted indirect branches in the kernel, but its use is limited due to causing a 50% performance hit.”
Jul 5
Europol Announces Crackdown on Cobalt Strike Servers Used by Cybercriminals securityweek.com · “A total of 690 IP addresses were flagged to online service providers in 27 countries. By the end of the week, 593 of these addresses had been taken down.”
Jul 5
Twilio Confirms Data Breach After Hackers Leak 33M Authy User Phone Numbers securityweek.com · “Twilio has detected that threat actors were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated endpoint.”
Jul 4
Evolve Bank data breach impacted fintech firms Wise and Affirm securityaffairs.com · “We no longer work with Evolve Bank & Trust, and USD account details are provided by a different bank.”
Jul 3
Juniper Networks flings out emergency patches for perfect 10 router vuln theregister.com · “An authentication bypass using an alternate path or channel vulnerability in Juniper Networks Session Smart Router or Conductor running with a redundant peer allows a network-based attacker to bypass authentication and take full control of the device”
Jul 3
regreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems qualys.com · “This regression was introduced in October 2020 (OpenSSH 8.5p1) by commit 752250c (“revised log infrastructure for OpenSSH”), which accidentally removed an “#ifdef DO_LOG_SAFE_IN_SIGHAND” from sigdie()”
Jul 1
TeamViewer's corporate network was breached in alleged APT hack bleepingcomputer.com · “However, though they say they aim to be transparent, the “TeamViewer IT security update” page contains a HTML tag, which prevents the document from being indexed by search engines and thus hard to find.”
Jul 1
Google to Block Entrust Certificates in Chrome Starting November 2024 thehackernews.com · “Affected website operators are urged to move to a publicly-trusted certificate authority owner to minimize disruption by October 31, 2024.”
Jul 1
CISA: Most critical open source projects not using memory safe code bleepingcomputer.com · “52% of critical open-source projects analyzed contain code written in memory-unsafe languages.”
Jul 1

June 2024 34 posts

How to Get Root Access to Your Sleep Number Bed dillan.org · “The hub communicates with the Sleep Number servers by opening an SSH tunnel and providing a reverse tunnel back to the hub that their developers can use to connect to the hub and do maintenance when needed.”
Jun 30
Do a firmware update for your AirPods – now blogs.gnome.org · “Once connected, an attacker can do everything a legitimate device can do, listen to the microphone, play music, see and pause the music that is currently playing from another connected device”
Jun 29
Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws memorycorruption.net · “As the vulnerability has been patched for months already (Factorio versions below 1.1.101 are affected), is time to share the details with the community.”
Jun 29
Critical GitLab bug lets attackers run pipelines as any user bleepingcomputer.com · “The vulnerability impacts all GitLab CE/EE versions from 15.8 through 16.11.4, 17.0.0 to 17.0.2, and 17.1.0 to 17.1.0.”
Jun 28
ID Verification Service for TikTok, Uber, X Exposed Driver Licenses 404media.co · “The breach highlights that identity services could themselves become a target for hackers.”
Jun 27
Project Naptime: Evaluating Offensive Security Capabilities of Large Language Models projectzero.google · “This approach achieves new top scores of 1.00 on the "Buffer Overflow" tests (from 0.05) and 0.76 on the "Advanced Memory Corruption" tests (from 0.24).”
Jun 26
Polyfill supply chain attack hits 100K+ sites sansec.io · “The new Chinese owner of the popular Polyfill JS project injects malware into more than 100 thousand sites.”
Jun 25
1-click Exploit in South Korea's biggest mobile chat app stulle123.github.io · “However, we didn’t receive any reward as only Koreans are eligible to receive a bounty.”
Jun 24
More Memory Safety for Let's Encrypt: Deploying ntpd-rs letsencrypt.org · “The CA software itself is written in memory safe Golang, but from our server operating systems to our network equipment, lack of memory safety routinely leads to vulnerabilities that need patching.”
Jun 24
New Government Ban on Kaspersky Would Prevent Company from Updating Malware Signatures in U.S. zetter-zeroday.com · “Asked what evidence the government found to support concerns that the Russian government is using Kaspersky software to spy on customers, Raimondo and other government officials on the call declined to provide specifics.”
Jun 21
Kraken Crypto Exchange Hit by $3 Million Theft Exploiting Zero-Day Flaw thehackernews.com · “This individual discovered the bug in our funding system, and leveraged it to credit their account with $4 in crypto.”
Jun 21
Massachusetts 911 Outage Caused by Errant Firewall securityweek.com · “The firewall prevented calls from getting to the 911 dispatch centers, also known as Public Safety Answer Points (PSAPs).”
Jun 21
Security bug allows anyone to spoof Microsoft employee emails techcrunch.com · “Microsoft just said they couldn’t reproduce it without providing any details.”
Jun 19
UK's Total Fitness exposed nearly 500K images of members, staff through unprotected database theregister.com · “Jeremiah Fowler told The Register more than 474,000 images of both members and staff – including men, women, and children – were stored in a database that was left unprotected and publicly accessible without the need for a password.”
Jun 19
Off-path TCP hijacking in NAT-enabled Wi-Fi networks blog.apnic.net · “Additionally, we conducted measurement studies on 93 real-world Wi-Fi networks and found that 75 (81%) of them were susceptible to this attack.”
Jun 18
Alleged Boss of 'Scattered Spider' Hacking Group Arrested krebsonsecurity.com · “A 22-year-old man from the United Kingdom arrested this week in Spain is allegedly the ringleader of Scattered Spider, a cybercrime group suspected of hacking into Twilio, LastPass, DoorDash, Mailchimp, and nearly 130 other organizations over the past two years.”
Jun 17
What You Get After Running an SSH Honeypot for 30 days blog.sofiane.cc · “There were a total of 11,599 login attempts. Divided by 30 days, this means an average of 386 login attempts per day.”
Jun 16
Security firm Cylance says it has been hacked, data put up for sale online techradar.com · “The data in question was accessed from a third-party platform unrelated to BlackBerry and appears to be from 2015-2018, predating BlackBerry’s acquisition of the Cylance product portfolio.”
Jun 14
Arm warns of actively exploited flaw in Mali GPU kernel drivers bleepingcomputer.com · “In 2022 Arm fixed a weakness in the r41p0 release for the Bifrost and Valhall Mali GPU kernel driver. An external researcher recently provided new information which reclassifies this weakness as a vulnerability.”
Jun 14
Microsoft Chose Profit Over Security and Left U.S. Government Vulnerable to Russian Hack, Whistleblower Says propublica.org · “Not only could Microsoft lose a multibillion-dollar deal, but it could also lose the race to dominate the market for cloud computing.”
Jun 13
Snowflake Breach Exposes 165 Customers' Data in Ongoing Extortion Campaign thehackernews.com · “The earliest infostealer infection date observed associated with a credential leveraged by the threat actor dated back to November 2020.”
Jun 12
750k Impacted by Frontier Communications Data Breach securityweek.com · “Frontier Communications is offering 12 months of free credit monitoring and identity theft services to the impacted individuals.”
Jun 10
Microsoft Will Switch Off Recall by Default After Security Backlash wired.com · “If you don’t proactively choose to turn it on, it will be off by default.”
Jun 7
OpenSSH introduces options to penalize undesirable behavior undeadly.org · “Repeated offenses by the same client address will accrue greater penalties, up to a configurable maximum.”
Jun 7
FBI obtains 7,000 LockBit ransomware decryption keys statescoop.com · “Though the gang still operates, reports show the mission disrupted its activities.”
Jun 7
Major cyberattack sees NHS London hospitals declare critical incident with operations cancelled independent.co.uk · “A senior NHS source told The Independent that transplants have been affected as patients’ blood tests cannot be cross-checked, and that healthcare leaders in London have been warned that the incident could take “weeks or months” to resolve.”
Jun 5
PSA: Bartender Mac App Under New Ownership, But Lack of Transparency Raises Concerns macrumors.com · “In the Reddit thread, the owners claim to have posted information about the sale on the website, but that has turned out to be untrue.”
Jun 4
Things the guys who stole my phone have texted me to try to get me to unlock it gothamist.com · “It helped that, even though this text came from a clearly bogus iCloud email address, Apple’s own “helpful” iMessage feature was sort of fooled: the auto-filled contact name said “Maybe: Apple Pay.” Maybe!”
Jun 4
Hacking Millions of Modems (and Investigating Who Hacked My Modem) samcurry.net · “This series of vulnerabilities demonstrated a way in which a fully external attacker with no prerequisites could’ve executed commands and modified the settings of millions of modems, accessed any business customer’s PII, and gained essentially the same permissions of an ISP support team.”
Jun 3
Japanese Crypto Exchange DMM Bitcoin Suffers $305M Hack coindesk.com · “In a blog post on its website, DMM Bitcoin said 4,502.9 BTC “leaked” out of the exchange.”
Jun 3
Netflix Paid Out Over $1 Million via Bug Bounty Program securityweek.com · “Rewards were paid out for 845 vulnerabilities, more than a quarter of which were rated ‘critical severity’ or ‘high severity’.”
Jun 3
Ticketmaster confirms data breach with a SEC filing stackdiary.com · “Likewise, at the time of this publication, Ticketmaster has not yet begun notifying its users of the data breach.”
Jun 1
Stealing everything you’ve ever typed or viewed on your own Windows PC is now possible with two lines of code: inside the Copilot+ Recall disaster simonwillison.net · “In practice, that audience’s needs are a very small (tiny, in fact) portion of Windows userbase”
Jun 1
Space secrets leak disclosure huggingface.co · “As a first step of remediation, we have revoked a number of HF tokens present in those secrets.”
Jun 1

May 2024 29 posts

Data breach exposes details of 25,000 current and former BBC employees theguardian.com · “In its email to those affected, the pension scheme did not explain how the breach had happened, beyond saying that private records had been “copied from an online data storage service”.”
May 31
Treasury Sanctions Creators of 911 S5 Proxy Botnet krebsonsecurity.com · “911 built its proxy network mainly by offering “free” virtual private networking (VPN) services.”
May 29
How Researchers Cracked an 11-Year-Old Password to a $3 Million Crypto Wallet wired.com · “The RoboForm program unwisely tied the random passwords it generated to the date and time on the user’s computer”
May 28
Almost all citizens of city of Eindhoven have their personal data exposed bitdefender.com · “Two files containing the personal data of 221,511 inhabitants of Eindhoven were accessible to unauthorised parties for a period of time last year.”
May 27
Google fixes eighth actively exploited Chrome zero-day this year bleepingcomputer.com · “CVE-2024-5274 is the eighth actively exploited vulnerability that Google fixed in Chrome since the beginning of the year, and the third this month.”
May 27
Abusing Go's infrastructure reverse.put.as · “Malware can simply store payloads and retrieve them from the proxy when needed.”
May 25
JAVS courtroom recording software backdoored in supply chain attack bleepingcomputer.com · “Attackers have backdoored the installer of widely used Justice AV Solutions (JAVS) courtroom video recording software”
May 24
Canada's London Drugs confirms ransomware attack after LockBit demands $25M theregister.com · “London Drugs is unwilling and unable to pay ransom to these cybercriminals.”
May 24
400,000 Impacted by CentroMed Data Breach securityweek.com · “The personal information of 400,000 individuals was compromised in a data breach at El Centro Del Barrio (CentroMed).”
May 24
Two students find security bug that could let millions do laundry for free theverge.com · “CSC never responded when Sherbrooke and Taranenko reported the vulnerability via emails and a phone call in January”
May 22
CVE-2024-4367: Arbitrary JavaScript execution in PDF.js codeanlabs.com · “On Electron apps that do not properly sandbox JavaScript code, this vulnerability even leads to native code execution (!).”
May 20
CVE-2023-52424 WiFi Vulnerability: The SSID Confusion Attack top10vpn.com · “The root cause of the vulnerability is that the IEEE 802.11 standard underpinning how WiFi works does not require the network name (SSID) to always be authenticated.”
May 17
900k Impacted by Data Breach at Mississippi Healthcare Provider securityweek.com · “In January, SRHS informed the Maine Attorney General’s Office that 252,890 individuals were impacted by the incident.”
May 17
Ebury botnet malware infected 400,000 Linux servers since 2009 bleepingcomputer.com · “Out of 4.8 million known_hosts entries collected by Ebury operators, about two million had their hostname hashed. 40% (about 800,000) of those hashed hostnames were guessed or brute forced.”
May 15
Boeing refused to pay $200 million ransomware demand from LockBit gang bitdefender.com · “If the $200 million figure is accurate, it would be one of the very highest ransom demands ever made by cyber-extortionists.”
May 13
Ohio Lottery data breach impacted over 538,000 individuals securityaffairs.com · “Attackers gained access to names or other personal identifiers in combination with Social Security Numbers of the impacted individuals.”
May 13
16 years of CVE-2008-0166 - Debian OpenSSL Bug 16years.secvuln.info · “It appears that a sizeable number of companies configured DKIM TXT records in 2007 and never changed them.”
May 12
Dell warns of data breach, 49 million customers allegedly affected bleepingcomputer.com · “We believe there is not a significant risk to our customers given the type of information involved.”
May 10
Georgia education agency's MOVEit data theft impacted 800K theregister.com · “US state law doesn’t set a deadline for reporting security breaches in the same way as the GDPR does, for example, so for those wondering what action USG will face for disclosing so late, the answer is probably none.”
May 10
Why Your VPN May Not Be As Secure As It Claims krebsonsecurity.com · “In our testing, the VPN always continued to report as connected, and the kill switch was never engaged to drop our VPN connection.”
May 8
UK confirms Ministry of Defence payroll data exposed in data breach bleepingcomputer.com · “It is estimated that 270,000 payroll records have been exposed.”
May 8
Introducing SecureDrop Protocol securedrop.org · “The server has access to minimal metadata, theoretically opening the door to deployment in adversarial environments.”
May 7
Dropbox says hackers stole customer data, auth secrets from eSignature service bleepingcomputer.com · “This configuration tool enabled the threat actor to execute applications and automated services with elevated privileges, allowing the attacker to access the customer database.”
May 6
A million Australian pubgoers wake up to find personal info listed on leak site theregister.com · “The leak site alleges Outabox contracted development of some software to offshore developers, and that those coders were given access to data gathered by gaming venues – including facial biometrics, scans of drivers’ licenses, and club membership details.”
May 6
Open Source Security (OpenSSF) and OpenJS Foundations Issue Alert for Social Engineering Takeovers of Open Source Projects openssf.org · “These social engineering attacks are exploiting the sense of duty that maintainers have with their project and community in order to manipulate them.”
May 5
DNS traffic can leak outside the VPN tunnel on Android mullvad.net · “These finding also shows once again that "Block connections without VPN" does not live up to its name (or documentation) and that it has multiple flaws.”
May 3
At Microsoft, years of security debt come crashing down cybersecuritydive.com · “Currently, Microsoft directs the vast majority of their security investments in revenue generating roles instead of internal security roles.”
May 1
Millions of Malicious 'Imageless' Containers Planted on Docker Hub Over 5 Years thehackernews.com · “Over four million of the repositories in Docker Hub are imageless and have no content except for the repository documentation.”
May 1
Google defended the Play Store from 2.28 million malicious apps last year androidpolice.com · “Last year’s report bragged about successfully defending Android’s crown jewel from 1.43 million apps, but this year’s report claims a whopping 2.28 million privacy-violating apps were stopped dead in their tracks.”
May 1

April 2024 40 posts

Apple users are being locked out of their Apple IDs with no explanation 9to5mac.com · “If you try to sign in with your original Apple ID password, you’ll be locked out of your account.”
Apr 27
Passkeys: A Shattered Dream fy.blackhats.net.au · “What better way to encourage long term entrapment of users then by locking all their credentials into your platform, and even better, credentials that can’t be extracted or exported in any capacity.”
Apr 26
The Not-So-Silent Type: Vulnerabilities Across Keyboard Apps Reveal Keystrokes to Network Eavesdroppers citizenlab.ca · “Our analysis found that eight of the nine apps identified contained vulnerabilities that could be exploited to completely reveal the contents of users’ keystrokes in transit.”
Apr 26
Cyber-attack leaves Leicester street lights permanently on bbc.co.uk · “It means we are currently not able to remotely identify faults in the street lighting system.”
Apr 26
UnitedHealth paid ransom to bad actors, says patient data was compromised in Change Healthcare cyberattack cnbc.com · “A ransom was paid as part of the company’s commitment to do all it could to protect patient data from disclosure.”
Apr 24
MITRE says state hackers breached its network via Ivanti zero-days bleepingcomputer.com · “No organization is immune from this type of cyber attack, not even one that strives to maintain the highest cybersecurity possible.”
Apr 24
What We Learned Inside a North Korean Internet Server: How Well Do You Know Your Partners? 38north.org · “The server, which appears no longer in use, had been incorrectly configured, making the daily flow of files into and out of this server viewable by anyone without a password.”
Apr 22
Akira Ransomware Made Over $42 Million in One Year: Agencies securityweek.com · “For initial access, Akira ransomware’s operators have been targeting VPN services that lacked multi-factor authentication, mainly using known vulnerabilities in Cisco products (such as CVE-2020-3259 and CVE-2023-20269).”
Apr 22
Microsoft is a national security threat, says ex-White House cyber policy director theregister.com · “If you go back to the SolarWinds episode from a few years ago … [Microsoft] was essentially up-selling logging capability to federal agencies.”
Apr 21
Some Fritz!Box modems might have been hijacked crapts.org · “Since the beginning of this year the fritz.box DNS suffix is an actual registered domain and the owner of this domain is not AVM or anyone affiliated to them.”
Apr 21
Russian Sandworm hackers pose as hacktivists in water utility breaches bleepingcomputer.com · “At one point, an error on APT44’s part resulted in Cyber Army of Russia Reborn claiming on their channel an attack that APT44 had not yet carried out.”
Apr 19
AWS took 6 months to fix STS bug that made minions admin thestack.technology · “We were well aware of IAM’s provable security via automated reasoning, and the documentation is so comprehensive (and intimidating at times) that we were sure it had to be our fault”
Apr 17
Crickets from Chirp Systems in Smart Lock Key Leak krebsonsecurity.com · “Chirp Systems has not responded to requests to work with CISA to mitigate this vulnerability.”
Apr 17
A quick post on Chen’s algorithm blog.cryptographyengineering.com · “If Chen’s result can be improved upon, then quantum algorithms could render obsolete an entire generation of “post-quantum” lattice-based schemes, forcing cryptographers and industry back to the drawing board.”
Apr 16
PuTTY vulnerability vuln-p521-bias chiark.greenend.org.uk · “An attacker in possession of a few dozen signed messages and the public key has enough information to recover the private key”
Apr 15
T-Mobile Employees Across The Country Receive Cash Offers To Illegally Swap SIMs tmo.report · “The texts offer the employee $300 per SIM swap, and asks the worker to contact them on telegram.”
Apr 15
Palo Alto Networks Warns of Exploited Firewall Vulnerability securityweek.com · “Tracked as CVE-2024-3400 and assigned a severity score of 10 out of 10, the security defect was identified in the GlobalProtect feature of PAN-OS”
Apr 15
Roku says 576,000 user accounts hacked after second security incident techcrunch.com · “Roku said it discovered the second incident while it was notifying some 15,000 Roku users that their accounts were compromised in an earlier credential stuffing attack.”
Apr 15
My Cat Alerted Me to a DDoS Attack dannyguo.com · “They generously offered to give us a “solution file” if we sent them $5,000 in Bitcoin.”
Apr 14
Sandboxing All The Things with Flatpak and BubbleBox ralfj.de · “Unfortunately, Flatpaks can come with extremely liberal default profiles that make the sandbox mostly pointless.”
Apr 14
Why CISA is Warning CISOs About a Breach at Sisense krebsonsecurity.com · “Both sources said the attackers used the S3 access to copy and exfiltrate several terabytes worth of Sisense customer data, which apparently included millions of access tokens, email account passwords, and even SSL certificates.”
Apr 12
Apple alerts users in 92 nations to mercenary spyware attacks techcrunch.com · “Apple previously described the attackers as “state-sponsored” but has replaced all such references with “mercenary spyware attacks.””
Apr 11
Twitter's Clumsy Pivot to X.com Is a Gift to Phishers krebsonsecurity.com · “On April 9, Twitter/X began automatically modifying links that mention “twitter.com” to read “x.com” instead.”
Apr 10
Microsoft fixes two Windows zero-days exploited in malware attacks bleepingcomputer.com · “Microsoft did not indicate they were patching this vulnerability, so it was a (welcome) surprise when the patch went live.”
Apr 10
Fake Facebook MidJourney AI page promoted malware to 1.2 million people bleepingcomputer.com · “In one of the cases seen by researchers at Bitdefender, a malicious Facebook page impersonating Midjourney amassed 1.2 million followers and remained active for nearly a year before it was eventually taken down.”
Apr 10
How I Tripped Over the Debian Weak Keys Vulnerability hezmatt.org · “Through a well-meaning but ultimately disasterous cleanup of OpenSSL’s randomness generation code, the Debian maintainer had inadvertently reduced the number of possible keys that could be generated by a given user from “bazillions” to a little over 32,000.”
Apr 9
Big Tech passkey implementations are a trap proton.me · “And both Apple and Google prevent you from exporting your passkeys, meaning you’ll need to create them all over again if you want to switch to another password manager.”
Apr 9
Hoya's optics production and orders disrupted by cyberattack bleepingcomputer.com · “At this time, we do not have a full restoration timeline for when our systems will be back online”
Apr 8
Help us to take down the parasite website notepad-plus-plus.org · “It is riddled with malicious advertisements on every page.”
Apr 8
Command Injection and Backdoor Account in D-Link NAS Devices github.com · “The request includes parameters for a username (user=messagebus) and an empty password field (passwd=).”
Apr 7
Google Public DNS's approach to fight against cache poisoning attacks security.googleblog.com · “Measurements indicate that the DNS Cookies do not provide sufficient coverage, even though around 40% of nameservers by IP support DNS Cookies, these account for less than 10% of overall query volume.”
Apr 7
Top Israeli spy chief exposes his true identity in online security lapse theguardian.com · “An electronic version of the book included an anonymous email address that can easily be traced to Sariel’s name and Google account.”
Apr 5
Google fixes two Pixel zero-day flaws exploited by forensics firms bleepingcomputer.com · “Forensic companies are rebooting devices in ‘After First Unlock’ state into fastboot mode on Pixels and other devices to exploit vulnerabilities there and then dump memory.”
Apr 5
HTTP/2 CONTINUATION Flood: Technical Details nowotarski.info · “During CONTINUATION Flood attack not a single request is made (no END_HEADERS flag)!”
Apr 4
Kobold letters lutrasecurity.com · “However, the moment the email appeared in your inbox, it changed.”
Apr 4
Omni Hotels experiencing nationwide IT outage since Friday bleepingcomputer.com · “They have it so you have to text them to come let you into your room, and it usually takes 30+ minutes for an employee to get there and unlock it for you.”
Apr 3
Timeline of the xz open source attack research.swtch.com · “It’s also good to keep in mind that this is an unpaid hobby project.”
Apr 2
AT&T confirms data breach and resets millions of customer passcodes theverge.com · “AT&T has acknowledged that a data leak making the rounds online contains information from more than 7.6 million current customers and 65 million former customers.”
Apr 1
Easy-to-use make-me-root exploit lands for recent Linux kernels. Get patching theregister.com · “Running the exploit as a normal user on a vulnerable machine will grant you root access to the box, allowing you to do whatever you want on it.”
Apr 1
Thread Hijacking: Phishes That Prey on Your Curiosity krebsonsecurity.com · “It works because you feel like you’re suddenly included in an important conversation.”
Apr 1

March 2024 35 posts

We are under DDoS attack and we do nothing tableplus.com · “In the last 5 days alone, they tried to download it more than 800K times - our setup file is approximately 200MB per download.”
Mar 30
backdoor in upstream xz/liblzma leading to ssh server compromise openwall.com · “The upstream xz repository and the xz tarballs have been backdoored.”
Mar 29
US offers $10M to help catch Change Healthcare hackers techcrunch.com · “The affiliate group went public after accusing the main ALPHV/BlackCat gang of swindling the contract hackers out of $22 million in ransom that Change Healthcare allegedly paid to prevent the mass leak of patient records.”
Mar 29
42.parquet: A Zip Bomb for the Big Data Age duckdb.org · “A 42 kB Parquet file can contain over 4 PB of data.”
Mar 28
Recent 'MFA Bombing' Attacks Targeting Apple Users krebsonsecurity.com · “KrebsOnSecurity tested Ken’s experience, and can confirm that enabling a recovery key does nothing to stop a password reset prompt from being sent to associated Apple devices.”
Mar 27
Attack on Software Supply Chains Using Fake Python Infrastructure checkmarx.com · “This domain selection is a clever typosquat of the official Python mirror "files.pythonhosted.org," as the latter is where the official artifact files of PyPi packages are typically stored.”
Mar 27
Germany warns of 17K vulnerable Microsoft Exchange servers exposed online bleepingcomputer.com · “Overall, at least 37% of Exchange servers in Germany (and in many cases also the networks behind them) are severely vulnerable.”
Mar 27
ZenHammer: Rowhammer Attacks on AMD Zen-based Platforms comsec.ethz.ch · “This result proves that AMD systems are equally vulnerable to Rowhammer as Intel systems”
Mar 25
New 'Loop DoS' attack may impact up to 300,000 online systems bleepingcomputer.com · “Loop DoS relies on IP spoofing and can be triggered from a single host that sends one message to start the communication.”
Mar 25
Hackers earn $1,132,500 for 29 zero-days at Pwn2Own Vancouver bleepingcomputer.com · “Competitors successfully gained code execution and escalated privileges on fully patched systems after hacking Windows 11, Ubuntu Desktop, VMware Workstation, Oracle VirtualBox, three web browsers (Apple Safari, Google Chrome, and Microsoft Edge), and the Tesla Model 3.”
Mar 22
Hackers Found a Way to Open Any of 3 Million Hotel Keycard Locks in Seconds wired.com · “Wouters and Carroll say they were nonetheless told by Dormakaba that, as of this month, only 36 percent of installed Safloks have been updated.”
Mar 21
Misconfigured Firebase instances leaked 19 million plaintext passwords bleepingcomputer.com · “For passwords, the problem gets worse because 98% of them, or 19,867,627 to be exact, are in plain text.”
Mar 20
White House, EPA warn water sector of cybersecurity threats cyberscoop.com · “In the absence of the EPA rules, the water sector continues to have no binding cybersecurity rules.”
Mar 20
Inside the Massive Alleged AT&T Data Breach troyhunt.com · “Taken at face value, it looks like whoever snagged this data also obtained the private encryption key and simply decrypted the vast bulk (but not all of) the protected values.”
Mar 19
Gaining kernel code execution on an MTE-enabled Pixel 8 github.blog · “So, by using the GPU to access physical addresses directly, I’m able to completely bypass the protection that MTE offers.”
Mar 19
900 Sites, 125 million accounts, 1 vulnerability env.fail · “24% of Site owners fixed the misconfiguration”
Mar 18
Death Knell of the NVD? resilientcyber.substack.com · “Another outstanding vulnerability researcher named Jerry Gamblin published research showing that since the date of February 15th, 90% of all published CVE’s are still awaiting processing and analysis.”
Mar 18
Fuzzing Ladybird with tools from Google Project Zero awesomekling.substack.com · “Unsurprisingly, it took less than a second to find the first issue!”
Mar 16
Introducing Sunlight, a CT implementation built for scalability, ease of operation, and reduced cost letsencrypt.org · “We previously had a test log fail when we ran into a 16TiB limit in MySQL.”
Mar 15
Stanford: Data of 27,000 people stolen in September ransomware attack bleepingcomputer.com · “The investigation determined that an unauthorized individual(s) gained access to the Department of Public Safety’s network between May 12, 2023, and Sept. 27, 2023.”
Mar 13
Stealing Part of a Production Language Model arxiv.org · “For under $20 USD, our attack extracts the entire projection matrix of OpenAI’s Ada and Babbage language models.”
Mar 12
Microsoft says Russian hackers stole source code after spying on its executives theverge.com · “Microsoft had configured a non-production test tenant account without two-factor authentication enabled, allowing Nobelium to gain access.”
Mar 11
the Apple curl security incident 12604 daniel.haxx.se · “Because the server certificate can be validated successfully using the built-in system trust store, we don’t consider this something that needs to be addressed in our platforms.”
Mar 9
Using LLMs to Generate Fuzz Generators verse.systems · “I found that Claude’s fuzzer is able to trigger the out-of-bounds read and write bugs only.”
Mar 9
FBI: U.S. lost record $12.5 billion to online crime in 2023 bleepingcomputer.com · “Investment fraud increased by 38% last year, causing confirmed losses of $4.57 billion.”
Mar 8
MiTM phishing attack can let attackers unlock and steal a Tesla bleepingcomputer.com · “The company replied by saying that its investigation determined that it was the intended behavior”
Mar 8
You can not simply publicly access private secure links, can you? vin01.github.io · “A link submitted to urlscan.io as unlisted, was accessed 12 times within 1 hour of submission”
Mar 7
BlackCat Ransomware Group Implodes After Apparent $22M Payment by Change Healthcare krebsonsecurity.com · “On March 1, a cryptocurrency address that security researchers had already mapped to BlackCat received a single transaction worth approximately $22 million.”
Mar 6
Cracking Meta's Messenger Certificate Pinning on macOS texts.blog · “By modifying just 4 of the binary’s 97,477,728 bytes we can now intercept requests!”
Mar 5
Epic Games Hackers Say They Faked The Whole Thing thegamer.com · “In reality, we are not a ransomware-as-a-service, but professional fraudsters.”
Mar 5
Products on your perimeter considered harmful (until proven otherwise) ncsc.gov.uk · “Attackers have realised that the majority of perimeter-exposed products aren’t ‘secure by design’, and so vulnerabilities can be found far more easily than in popular client software.”
Mar 4
A leaky database spilled 2FA codes for the world's tech giants techcrunch.com · “When asked by TechCrunch, the YX International representative said that the server did not store access logs, which would have determined if anyone other than Sen discovered the exposed database and its contents.”
Mar 4
Popular video doorbells can be easily hijacked, researchers find techcrunch.com · “Despite these flaws and Consumer Reports warning online marketplaces about them, the doorbells remain available for sale on Amazon, Sears and Shein.”
Mar 1
How we applied advanced fuzzing techniques to cURL blog.trailofbits.com · “hsts.c, which provides functions for parsing and handling the Strict-Transport-Security response header, had only 4.46% line coverage, 18.75% function coverage, and 2.56% region coverage after over five years on OSS-Fuzz”
Mar 1
Data Scientists Targeted by Malicious Hugging Face ML Models with Silent Backdoor jfrog.com · “While Hugging Face conducts scans on pickle models, it doesn’t outright block or restrict them from being downloaded, but rather marks them as “unsafe””
Mar 1

February 2024 32 posts

New Hugging Face Vulnerability Exposes AI Models to Supply Chain Attacks thehackernews.com · “An attacker could gain a foothold into the container running the service and compromise any model converted by the service.”
Feb 28
Crooks stole $10 million from Axie Infinity co-founder securityaffairs.com · “On February 23, researchers at blockchain cybersecurity firm PeckShield alerted about a “whale wallet” compromise over the Ronin Bridge.”
Feb 26
Thanks FedEx, This is Why we Keep Getting Phished troyhunt.com · “It’s quite unbelievable what they’ve done with the link because it makes the SMS entirely unactionable.”
Feb 23
Hidden GitHub Commits and How to Reveal Them neodyme.io · “The events endpoint still lists all PushEvents even from the time it was private”
Feb 23
Insecure vehicles should be banned, not security tools like the Flipper Zero saveflipper.ca · “This policy fails to recognize that these tools are not the enemy, rather, insecure products are.”
Feb 21
Recent Zero-Day Could Impact Up to 97,000 Microsoft Exchange Servers securityweek.com · “According to Microsoft, the issue exists because Exchange Server 2019 did not have NTLM credential relay protection, or Extended Protection for Authentication (EPA), enabled by default.”
Feb 21
Seized ransomware network LockBit rewired to expose hackers to world theguardian.com · “Some of the data it discovered on LockBit’s systems belonged to victims who had paid the ransom.”
Feb 21
iMessage with PQ3: The new state of the art in quantum-secure messaging at scale security.apple.com · “PQ3 is the first messaging protocol to reach what we call Level 3 security”
Feb 21
U.S. Internet Leaked Years of Internal, Customer Emails krebsonsecurity.com · “KrebsOnSecurity has been writing about data breaches for nearly two decades, but this one easily takes the cake in terms of the level of incompetence needed to make such a huge mistake unnoticed.”
Feb 19
ExpressVPN User Data Exposed Due to Bug securityweek.com · “Normally, when a user is connected to ExpressVPN, their DNS requests are sent to the company’s servers.”
Feb 19
Community Alert: Ongoing Azure Attacks Utilizing Phishing and Cloud ATO proofpoint.com · “Attackers access and download sensitive files, including financial assets, internal security protocols, and user credentials.”
Feb 19
US military notifies 20,000 of data breach after cloud email leak techcrunch.com · “Anyone with the public IP address of the exposed cloud email server could access the sensitive but unclassified emails inside using only a web browser.”
Feb 16
Ransomware attack forces 100 Romanian hospitals to go offline bleepingcomputer.com · “The Hipocrate Information System (HIS) used by hospitals to manage medical activity and patient data was targeted over the weekend and is now offline after its database was encrypted.”
Feb 16
French Healthcare Payments Processor Breaches Affect Half of Population securityweek.com · “France’s data protection agency CNIL is investigating massive data breaches at two companies that manage third-party healthcare payments, warning that more than 33 million people may be affected.”
Feb 14
Bank of America warns customers of data breach after vendor hack bleepingcomputer.com · “While Bank of America has yet to disclose how many customers were impacted by the data breach, an IMS breach notification letter filed with the Attorney General of Maine on behalf of Bank of America revealed that a total of 57,028 people were directly impacted.”
Feb 14
Wi-Fi jamming to knock out cameras suspected in nine Minnesota burglaries -- smart security systems vulnerable as tech becomes cheaper and easier to acquire tomshardware.com · “Edina police suspect that nine burglaries in the last six months have been undertaken with Wi-Fi jammer(s) deployed to ensure incriminating video evidence wasn’t available to investigators.”
Feb 13
Juniper Support Portal Exposed Customer Device Info krebsonsecurity.com · “If you don’t have a support contract you don’t get updates, it’s as simple as that,”
Feb 12
Phishception - SendGrid is abused to host phishing attacks impersonating itself netcraft.com · “the criminals can use the compromised accounts to compromise further SendGrid accounts in a cycle, providing them with a steady supply of fresh SendGrid accounts.”
Feb 12
Ransomware payments reached record $1.1 billion in 2023 bleepingcomputer.com · “Ransomware payments in 2023 soared above $1.1 billion for the first time, shattering previous records and reversing the decline seen in 2022, marking the year as an exceptionally profitable period for ransomware gangs.”
Feb 9
Security flaw in a popular smart helmet allowed silent location tracking techcrunch.com · “That 6-digit group code simply isn’t random enough,”
Feb 9
Federal action on combatting auto theft canada.ca · “such as the Flipper Zero, which would allow for the removal of those devices from the Canadian marketplace”
Feb 8
Finance worker pays out $25 million after video call with deepfake 'chief financial officer' cnn.com · “(In the) multi-person video conference, it turns out that everyone [he saw] was fake,”
Feb 7
Companies embracing SMS for account logins should be blamed for SIM-swap attacks keydiscussions.com · “But here’s the thing: carriers’ security has always been bad, it has even been legislated into being bad, and other companies have still chosen to build mission-critical systems on top of that weak link.”
Feb 6
Confirming Large-Scale Pegasus Surveillance of Jordan-based Civil Society citizenlab.ca · “At least 14 of the victims confirmed by Citizen Lab analysis work in media, such as journalists or staff. The rest are activists, lawyers, and other members of civil society.”
Feb 5
Clorox Says Cyberattack Costs Exceed $49 Million securityweek.com · “The Company has not recognized any insurance proceeds in the three and six months ended December 31, 2023 related to the cyberattack.”
Feb 5
DEF CON 32 Was Canceled. We Un-Canceled it. forum.defcon.org · “We don’t know why Caesars canceled us, they won’t say beyond it being a strategy change and it is not related to anything that DEF CON or our community has done.”
Feb 5
New Linux glibc flaw lets attackers get root on major distros bleepingcomputer.com · “The bug is due to a heap-based buffer overflow weakness accidentally introduced in glibc 2.37 in August 2022 and later backported to glibc 2.36 when addressing a less severe vulnerability tracked as CVE-2022-39046.”
Feb 4
Google has another secret browser matan-h.com · “A full untraceable browser inside the parental lock-down mode!”
Feb 2
Leaky Vessels: Docker and runc Container Breakout Vulnerabilities - January 2024 labs.snyk.io · “This could occur by running a malicious image or by building a container image using a malicious Dockerfile or upstream image”
Feb 2
Thanksgiving 2023 security incident blog.cloudflare.com · “Unfortunately, we failed to rotate one service token and three service accounts (out of thousands) of credentials that were leaked during the Okta compromise.”
Feb 1
A Startup Allegedly ‘Hacked the World.’ Then Came the Censorship, and Now the Backlash wired.com · “These efforts have demanded that more than a dozen publications amend or fully remove references to the original Appin Technology’s alleged illegal hacking or, in some cases, mentions of that company’s cofounder, Rajat Khare.”
Feb 1
How paid editors squeeze you dry en.wikipedia.org · “We estimate that the proceeds of this scam in 2023 were at least $500,000, and perhaps well over $1,000,000.”
Feb 1

January 2024 11 posts

I looked through attacks in my access logs. Here's what I found nishtahir.com · “The lesson here seems to be to expose the absolute bare minimum to the public internet.”
Jan 28
Rook to XSS: How I hacked chess.com with a rookie exploit skii.dev · “However, in this case, TinyMCE was up-to-date and had been configured correctly not to allow scripting tags and attributes.”
Jan 26
What's that touchscreen in my room? laplab.me · “Turns out, interface on the Android tablet is just a webview.”
Jan 20
German law is making security research a risky business infosec.exchange · “But the court ruling says: yes, there was a password, so there is a protection mechanism which was circumvented, and that’s hacking.”
Jan 18
Hacking into a Toyota/Eicher Motors insurance company by exploiting their premium calculator website eaton-works.com · “If I were them, I would not want a random stranger having access to their corporate cloud for 5 months.”
Jan 17
Microsoft suggests command line fiddling to get faulty Windows 10 update installed theregister.com · “These instructions are not for the faint of heart.”
Jan 14
Playing with Fire – How We Executed a Critical Supply Chain Attack on PyTorch johnstawinski.com · “Security tends to lag behind adoption, and AI/ML is no exception.”
Jan 12
Framework discloses data breach after accountant gets phished bleepingcomputer.com · “Customers are urged to contact the company’s support team about any suspicious emails they receive.”
Jan 12
How I pwned half of America's fast food chains, simultaneously. mrbruh.com · “My hunch was that in the rush to push their new shiny product, someone would take a shortcut…”
Jan 9
Chromium Money Tree Browser lyra.horse · “The bug bounty reward gets divided between files, eg if a fix to a $1000 bug changed 5 files, each file gets $200”
Jan 6
The I in LLM stands for intelligence daniel.haxx.se · “Every security report has to have a human spend time to look at it and assess what it means.”
Jan 2

2023 224 posts

December 2023 27 posts

Malware abuses Google OAuth endpoint to 'revive' cookies, hijack accounts bleepingcomputer.com · “BleepingComputer has contacted Google multiple times over a month with questions about these claims and how they plan to mitigate the issue, but we never received a response.”
Dec 29
Operation Triangulation: The last (hardware) mystery securelist.com · “Because this feature is not used by the firmware, we have no idea how attackers would know how to use it.”
Dec 27
No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability joshua.hu · “If in the future you are able to reproduce this issue using a different device that’s running iOS 17 or later, please let us know.”
Dec 27
GTA 5 source code leaks online, giving Rockstar a huge blow on Christmas: Report sportskeeda.com · “According to a report by popular YouTuber SKizzle on X on December 24, 2023, the entire source code of Grand Theft Auto 5 was leaked publicly.”
Dec 25
Xfinity Data Breach Impacts 36 Million Individuals securityweek.com · “Comcast recently reported having roughly 32 million customers, which suggests that the data breach could affect all Xfinity customers and possibly employees as well.”
Dec 22
SMTP Smuggling - Spoofing E-Mails Worldwide sec-consult.com · “CERT/CC allows public release of SMTP smuggling, since no software vulnerabilities were identified ("it’s not a bug, it’s a feature")”
Dec 21
Google OAuth is Broken (Sort Of) trufflesecurity.com · “Because these non-Gmail Google accounts aren’t actually a member of the Google organization, they won’t show up in any administrator settings, or user Google lists.”
Dec 21
Terrapin attacks can downgrade security of OpenSSH connections bleepingcomputer.com · “Terrapin is not a simple software bug that can be fixed with an update to a single library or component.”
Dec 20
Delta Dental of California data breach exposed info of 7 million people bleepingcomputer.com · “Based on this, the data breach has so far impacted 6,928,932 customers of Delta Dental of California, who had their names, financial account numbers, and credit/debit card numbers, including security codes, exposed.”
Dec 20
Ten Years Later, New Clues in the Target Breach krebsonsecurity.com · “When ChronoPay’s internal emails were leaked in 2010, the username and password for its MegaPlan subscription were still working and valid.”
Dec 18
Bluetooth keystroke-injection in Android, Linux, macOS and iOS github.com · “The Linux vulnerability was fixed in 2020 (CVE-2020-0556), but the fix was left disabled by default.”
Dec 16
Data exfiltration from Writer.com with indirect prompt injection promptarmor.substack.com · “Dec 5: Writer responds "We do not consider this to be a security issue since the real customer accounts do not have access to any website."”
Dec 15
Ubiquiti users claim to have access to other people's devices securityaffairs.com · “However this time I was presented with 88 consoles from another account. I had full access to these consoles, just as I would my own.”
Dec 15
Bricked Xmas whizzy.org · “I guess I overflowed some buffer and I’ve corrupted the firmware.”
Dec 15
Polish Hackers Repaired Trains the Manufacturer Artificially Bricked. Now The Train Company Is Threatening Them 404media.co · “NEWAG, the manufacturer of the Impuls family of trains, put code in the train’s control systems that prevented them from running if a GPS tracker detected that it spent a certain number of days in an independent repair company’s maintenance center”
Dec 13
Cloud engineer gets 2 years for wiping ex-employer's code repos bleepingcomputer.com · “Following his dismissal, Brody allegedly refused to return his work laptop and instead used his still-valid account to access the bank’s computer network”
Dec 13
Norton Healthcare Ransomware Hack: 2.5 Million Personal Records Stolen securityweek.com · “While the notice did not say how many individuals were affected, Norton Healthcare informed the Maine Attorney General’s Office that the attackers stole the personal information of 2.5 million individuals.”
Dec 13
Hacktivists hacked a Irish water utility and interrupted water supply securityaffairs.com · “Our caretaker went down and when he got to the pumphouse, up on the screen was a sign ‘You have been hacked’.”
Dec 11
Report: 2.6 billion personal records compromised by data breaches in past two years: underscoring need for end-to-end encryption apple.com · “The findings underscore that strong protections against data breaches in the cloud, like end-to-end encryption, have only grown more essential since last year’s report and the launch of Advanced Data Protection for iCloud.”
Dec 11
More than 1500 HuggingFace API Tokens Were Exposed lasso.security · “Intriguingly, among these accounts, 655 users’ tokens were found to have write permissions, 77 of them to various organizations, granting us full control over the repositories of several prominent companies.”
Dec 10
pinning all system calls marc.info · “The ping(1) binary does not call execve(2) or fork(2). So now you can’t ever call fork() or execve() because there is no “syscall” instruction for those two system calls.”
Dec 9
Dieselgate, but for trains - some heavyweight hardware hacking badcyber.com · “A condition has been written in the computer code to disable the ability to run a train if it spends at least 10 days in one of these workshops.”
Dec 8
15,000 Go Module Repositories on GitHub Vulnerable to Repojacking Attack thehackernews.com · “A third-party can’t reasonably register 15,000 GitHub accounts.”
Dec 6
23andMe confirms hackers stole ancestry data on 6.9 million users techcrunch.com · “On Friday, genetic testing company 23andMe announced that hackers accessed the personal data of 0.1% of customers, or about 14,000 individuals.”
Dec 5
Security flaws in court record systems used in five US states exposed sensitive legal documents techcrunch.com · “One of the bugs was as easy to exploit as incrementing a document number in the browser’s address bar of one Florida court records system, said Parker.”
Dec 4
A Decade of Have I Been Pwned troyhunt.com · “The project I built out of a passion to do community good was now being used as a tool to extract as much money out of me as possible.”
Dec 4
Report Phone Spam - Shut down robocallers & text spammers reportphonespam.org · “Blocking a phone number is a bit better than nothing, but not much.”
Dec 3

November 2023 24 posts

Extracting Training Data from ChatGPT not-just-memorization.github.io · “It’s wild to us that our attack works and should’ve, would’ve, could’ve been found earlier.”
Nov 29
Iranian hacker group Cyber Av3ngers hacked the Municipal Water Authority of Aliquippa in Pennsylvania securityaffairs.com · “During the weekend, Iranian threat actors hacked the Municipal Water Authority of Aliquippa (MWAA) and took control of one of their booster stations.”
Nov 29
BlackCat claims it is behind Fidelity National Financial ransomware shakedown theregister.com · “Wouldn’t want to disclose every card at this early stage.”
Nov 27
Making it clear when we're on a call with you to protect you from fraud monzo.com · “Since we launched this feature, we’ve seen approximately 700 fraud reports each month directly within Call Status.”
Nov 26
Third-party data breach affecting Canadian government could involve data from 1999 theregister.com · “The government of Canada has confirmed its data was accessed after two of its third-party service providers were attacked.”
Nov 22
Ransomware gang files SEC complaint over victim's undisclosed breach bleepingcomputer.com · “The ALPHV/BlackCat ransomware operation has taken extortion to a new level”
Nov 20
Nothing Chats, the Sunbird-based iMessage app, is a privacy nightmare with unencrypted messages and images 9to5google.com · “Sunbird has access to every message sent and received through the app.”
Nov 20
Royal Mail’s recovery from ransomware attack will cost business at least $12M theregister.com · “The total costs related to the attack are likely to be higher but International Distribution Services, or IDS, has not pinned hard figures to these.”
Nov 17
New CacheWarp AMD CPU attack lets hackers gain root in Linux VMs bleepingcomputer.com · “In 3 case studies, we demonstrate an attack on RSA in the Intel IPP crypto library, recovering the entire private key, logging into an OpenSSH server without authentication, and escalating privileges to root via the sudo binary.”
Nov 15
Poloniex exchange suffers $100M exploit, offers 5% bounty cointelegraph.com · “Sun also offered a 5% white-hat bounty to the Poloniex hacker.”
Nov 15
Reptar lock.cmpxchg8b.com · “We verified this worked even inside an unprivileged guest VM, so this already has serious security implications for cloud providers.”
Nov 14
Hacking Google Bard - From Prompt Injection to Data Exfiltration embracethered.com · “Indirect Prompt Injection attacks via Emails or Google Docs are interesting threats, because these can be delivered to users without their consent.”
Nov 13
Marina Bay Sands Discloses Data Breach Impacting 665k Customers securityweek.com · “The company said it had found no evidence that the exposed data was misused to “cause harm to customers”.”
Nov 13
It's Still Easy for Anyone to Become You at Experian krebsonsecurity.com · “Your only option at this point is recreate your account at Experian and steal it back from the ID thieves!”
Nov 11
Microsoft lays hands on login data: Beware of the new Outlook heise.de · “Without informing or inquiring about this, Microsoft grants itself access to the IMAP and SMTP login data of users of the new Outlook.”
Nov 10
Confluence flaw severity raised amid mass exploitation theregister.com · “In the recently updated advisory, it conceded an attacker could reset Confluence and create an administrator account.”
Nov 10
Mr. Cooper says customer data exposed during cyberattack techcrunch.com · “Mr. Cooper said it expects to incur up to $10 million in additional vendor costs during its fiscal fourth quarter, adding that it does not expect a material impact to its business.”
Nov 10
Article 45 Will Roll Back Web Security by 12 Years eff.org · “Article 45 forbids browsers from enforcing modern security requirements on certain CAs without the approval of an EU member government.”
Nov 7
First handset with MTE on the market projectzero.google · “Currently, MTE is only available on the Pixel as a developer option, intended for app developers to test their apps using MTE”
Nov 6
Ace Hardware says 1,202 devices were hit during cyberattack bleepingcomputer.com · “On Sunday morning, we detected a cybersecurity incident that is impacting the majority of our IT systems,”
Nov 6
.US Harbors Prolific Malicious Link Shortening Service krebsonsecurity.com · “We have not found any legitimate content served through their shorteners.”
Nov 3
Dozens of countries will pledge to stop paying ransomware gangs bleepingcomputer.com · “An alliance of 40 countries will sign a pledge during the third annual International Counter-Ransomware Initiative summit in Washington, D.C., to stop paying ransoms demanded by cybercriminal groups.”
Nov 3
SEC sues SolarWinds for misleading investors before 2020 hack bleepingcomputer.com · “We allege that, for years, SolarWinds and Brown ignored repeated red flags about SolarWinds’ cyber risks, which were well known throughout the company and led one of Brown’s subordinates to conclude: ‘We’re so far from being a security minded company,’”
Nov 1
Finding You: The Network Effect of Telecommunications Vulnerabilities for Location Disclosure citizenlab.ca · “Telecom insiders understand that the vulnerabilities in the SS7 signaling protocol used in 3G roaming have enabled the development of commercial surveillance products that provide their operators with anonymity, multiple access points and attack vectors, a ubiquitous and globally-accessible network with an unlimited list of targets, and virtually no financial or legal risks.”
Nov 1

October 2023 26 posts

Sophisticated StripedFly Spy Platform Masqueraded for Years as Crypto Miner zetter-zeroday.com · “It made just $10 in 2017 mining Monero cryptocurrency, and about $500 in 2018.”
Oct 30
Citrix warns admins to patch NetScaler CVE-2023-4966 bug immediately bleepingcomputer.com · “Mandiant cautioned that compromised sessions persist even after patching and, depending on the compromised accounts’ permissions, attackers could move laterally across the network or compromise other accounts.”
Oct 30
Signed Windows Installer github.com · “Digicert seems to be our only option now but a certificate there would cost $629 (tax excluded) for a single year.”
Oct 29
iLeakage: Browser-Based Timerless Speculative Execution Attacks on Apple Devices ileakage.com · “We recover YouTube watch history from the Chrome browser for iOS, which is a shell on top of Safari’s browsing engine due to Apple’s App Store policy.”
Oct 25
Okta's latest hack fallout hits Cloudflare, 1Password techcrunch.com · “BeyondTrust said it notified Okta of the incident on October 2, but accused Okta of not acknowledging the breach for almost three weeks.”
Oct 25
Why We Don’t Generate Elliptic Curves Every Day words.filippo.io · “Second, and most importantly, verifying the validity of parameters is even harder than generating them. For example, picking a random prime is way easier than adversarially checking if a given number is prime. This adds a tremendous amount of complexity to the security-critical, attacker-reachable hot path.”
Oct 24
Stealing OAuth tokens of connected Microsoft accounts via open redirect in Harvest App eval.blog · “After 3 years of reporting, the company finally fixed the vulnerability silently and didn’t bother to inform. On 1st August 2023, I tested the vulnerability again and found it fixed. The report is still marked as triage as of 21 October 2023, and their bug bounty policy mentions rewards but no bounty or even HackerOne points were rewarded by the company.”
Oct 22
with firefox on X11, any page can pastejack you anytime openwall.com · “In firefox running on X11, any script from any page can freely write to the primary selection, and that can be easily exploited to run arbitrary code on the user’s machine.”
Oct 21
Encrypted traffic interception on Hetzner and Linode targeting the largest Russian XMPP (Jabber) messaging service notes.valdikss.org.ru · “The attacker has issued several new TLS certificates using Let’s Encrypt service which were used to hijack encrypted STARTTLS connections on port 5222 using transparent MiTM proxy. The attack was discovered due to expiration of one of the MiTM certificates, which haven’t been reissued.”
Oct 20
Hackers Stole Access Tokens from Okta’s Support Unit krebsonsecurity.com · “Maiffret said BeyondTrust followed up with Okta on Oct. 3 and said they were fairly confident Okta had suffered an intrusion, and that he reiterated that conclusion in a phone call with Okta on October 11 and again on Oct. 13.”
Oct 20
Cisco warns of new IOS XE zero-day actively exploited in attacks bleepingcomputer.com · “Successful exploitation of this vulnerability allows an attacker to create an account on the affected device with privilege level 15 access, effectively granting them full control of the compromised device and allowing possible subsequent unauthorized activity.”
Oct 18
Equifax Fined $13.5 Million Over 2017 Data Breach securityweek.com · “Furthermore, the FCA points out that Equifax Ltd learned that UK consumer data had been compromised only 6 weeks after the hack was discovered, minutes before the American parent company made the incident public”
Oct 18
The Fake Browser Update Scam Gets a Makeover krebsonsecurity.com · “Tal said hosting malicious files on the Binance Smart Chain is ideal for attackers because retrieving the malicious contract is a cost-free operation that was originally designed for the purpose of debugging contract execution issues without any real-world impact.”
Oct 18
55 Vulnerabilities in Squid Caching Proxy and 35 0days joshua.hu · “The Squid Team have been helpful and supportive during the process of reporting these issues. However, they are effectively understaffed, and simply do not have the resources to fix the discovered issues.”
Oct 16
Multi-modal prompt injection image attacks against GPT-4V simonwillison.net · “I was really surprised to see this work: I had assumed OpenAI would block Markdown images like this from loading content from external servers. Johann disclosed the Markdown exfiltration vulnerability to them in April”
Oct 14
SOCKS5 heap buffer overflow - CVE-2023-38545 curl.se · “Typical server latency is likely “slow” enough to trigger this bug without an attacker needing to influence it by DoS or SOCKS server control.”
Oct 13
Tainting the CSAM client-side scanning database. blog.xot.nl · “There is no independent way for the service providers or the devices to verify that the fingerprints in this data actual correspond to CSAM.”
Oct 13
Cloud gaming firm Shadow says hackers stole customers' personal data techcrunch.com · “This highly sophisticated attack began on the Discord platform with the downloading of malware under cover of a game on the Steam platform, proposed by an acquaintance of our employee, himself a victim of the same attack.”
Oct 13
Slack's Google Drive App can share your private Docs and Drive files kapwing.com · “The problem is, that preview image gets re-uploaded to Slack’s CDN, and is in high resolution and is now accessible to everyone in my Slack workspace.”
Oct 12
Phishers Spoof USPS, 12 Other Natl' Postal Services krebsonsecurity.com · “Alas, running a search for domains registered through Alibaba to anyone claiming to reside in Georgia, AL reveals nearly 300 recent postal phishing domains ending in “.top.””
Oct 11
Google Cloud mitigated largest DDoS attack, peaking above 398 million rps cloud.google.com · “For a sense of scale, this two minute attack generated more requests than the total number of article views reported by Wikipedia during the entire month of September 2023.”
Oct 10
MGM Resorts confirms hackers stole customers' personal data during cyberattack techcrunch.com · “MGM’s filing with regulators reveals that the company expects the attack to reduce its third-quarter profit by approximately $100 million.”
Oct 9
Announcing the $12k NIST Elliptic Curves Seeds Bounty words.filippo.io · “The NIST elliptic curves that power much of modern cryptography were generated in the late ‘90s by hashing seeds provided by the NSA.”
Oct 5
ShellTorch: Multiple Critical Vulnerabilities in PyTorch Model Server (TorchServe) (CVSS 9.9, CVSS 9.8) Threatens Countless AI Users oligo.security · “TorchServe’s documentation claims that the default management API can be accessed only from localhost by default.”
Oct 4
The inability to count correctly: Debunking NIST's calculation of the Kyber-512 security level blog.cr.yp.to · “NIST’s underlying calculation of the security level was a severe and indefensible miscalculation.”
Oct 3
Millions of Exim mail servers exposed to zero-day RCE attacks bleepingcomputer.com · “Just over 3.5 million Exim servers are currently exposed online per a Shodan search, most of them in the United States, followed by Russia and Germany.”
Oct 2

September 2023 31 posts

Lazarus luring employees with trojanized coding challenges: The case of a Spanish aerospace company welivesecurity.com · “The fake recruiter contacted the victim via LinkedIn Messaging, a feature within the LinkedIn professional social networking platform, and sent two coding challenges required as part of a hiring process, which the victim downloaded and executed on a company device.”
Sep 30
Russian zero-day seller offers $20M for hacking Android and iPhones techcrunch.com · “On Wednesday, Operation Zero announced on its Telegram accounts and on its official account on X, formerly Twitter, that it was increasing payments for zero-days in those platforms from $200,000 to $20 million.”
Sep 29
Government Shutdown Could Bench 80% of CISA Staff securityweek.com · “In the case of CISA, which had 3,117 employees as of June 17, only 571 would remain during a lapse in appropriations.”
Sep 29
Wifi without internet on a Southwest flight jamesbvaughan.com · “It’s a long enough flight that I planned to purchase the $8 internet access and get some work done, but Southwest’s wifi portal wouldn’t accept any form of payment.”
Sep 28
WebGPU Technical Report chromium.googlesource.com · “Vulnerabilities in the SwiftShader JIT compiler aren’t being fixed in the SwiftShader codebase.”
Sep 28
Decade of newborn child registry data stolen in MOVEit mass-hack techcrunch.com · “Ontario’s government-funded birth registry has confirmed a data breach affecting some 3.4 million people who sought pregnancy care, including the personal health data of close to two million newborns and children across the Canadian province.”
Sep 27
Blocking Visual Studio Code embedded reverse shell before it's too late ipfyx.fr · “An attacker just has to upload the binary, which won’t be detected by any anti-virus since it is legitimate and singed windows binary.”
Sep 23
0-days exploited by commercial surveillance vendor in Egypt blog.google · “In the case of this campaign, if the target went to any ‘http’ site, the attackers injected traffic to silently redirect them to an Intellexa site, c.betly[.]me.”
Sep 22
38TB of data accidentally exposed by Microsoft AI researchers wiz.io · “In addition to the overly permissive access scope, the token was also misconfigured to allow “full control” permissions instead of read-only.”
Sep 22
The bogus CVE problem lwn.net · “For the curl bug, which should probably not be scored at all, NVD initially came up with a "9.8 critical", scoring an integer overflow in a delay parameter as one of the most severe types of vulnerability possible.”
Sep 22
The WebP 0day blog.isosceles.com · “This bug also shows that we have an over-reliance on fuzzing for security assurance of complex parser code.”
Sep 21
Hackers breached International Criminal Court’s systems last week bleepingcomputer.com · “At the end of last week, the International Criminal Court’s services detected anomalous activity affecting its information systems”
Sep 20
Quantum Resistance and the Signal Protocol signal.org · “We then combine these two shared secrets together so that any attacker must break both X25519 and CRYSTALS-Kyber to compute the same shared secret.”
Sep 19
Peach Sandstorm password spray campaigns enable intelligence collection at high-value targets microsoft.com · “Activity observed in this campaign aligned with an Iranian pattern of life, particularly in late May and June, where activity occurred almost exclusively between 9:00 AM and 5:00 PM Iran Standard Time (IRST).”
Sep 18
Hackers claim it only took a 10-minute phone call to shut down MGM Resorts engadget.com · “The conversation that granted initial access took just 10 minutes, according to the group.”
Sep 15
When MFA isn't actually MFA retool.com · “But through this Google update, what was previously multi-factor-authentication had silently (to administrators) become single-factor-authentication, because control of the Okta account led to control of the Google account, which led to control of all OTPs stored in Google Authenticator.”
Sep 13
The million-dollar reporter meduza.io · “Timchenko’s hacked iPhone had a Latvian SIM card. Citizen Lab recorded the first Pegasus-related activity in Latvia in 2018, and experts believe Riga still uses NSO Group’s products today, says Scott-Railton.”
Sep 13
Bug in macOS 14 Sonoma prevents our app from working mullvad.net · “Firewall rules do not get applied properly to network traffic, and traffic that is not supposed to be allowed is allowed.”
Sep 13
'Evil Telegram' Android apps on Google Play infected 60K with spyware bleepingcomputer.com · “When the user receives a message through the trojanized app, the spyware sends a copy straight to the operator’s command and control (C2) server”
Sep 11
Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach krebsonsecurity.com · “I had my test account since 2018, and even today I can log in with my eight-character password without any warnings or prompts to change it.”
Sep 8
Android 14 blocks modification of system certificates, even as root httptoolkit.com · “In this new release, the restrictions around certificate authority (CA) certificates become significantly tighter, and appear to make it impossible to modify the set of trusted certificates at all, even on fully rooted devices.”
Sep 8
BLASTPASS: NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in the Wild citizenlab.ca · “The exploit chain was capable of compromising iPhones running the latest version of iOS (16.6) without any interaction from the victim.”
Sep 7
Active North Korean campaign targeting security researchers blog.google · “In one case, they carried on a months-long conversation, attempting to collaborate with a security researcher on topics of mutual interest.”
Sep 7
4,500 of the Top 1 Million Websites Leaked Source Code, Secrets trufflesecurity.com · “After reviewing the permissions granted to each valid GitHub PAT, we discovered the majority (67%) had admin-level privileges.”
Sep 6
Data Breach (August 2023) freecycle.helpscoutdocs.com · “The breach of data includes usernames, User IDs, email addresses and passwords.”
Sep 6
Ask HN: I'm an FCC Commissioner proposing regulation of IoT security updates news.ycombinator.com · “Many manufacturers oppose making any commitments about security updates, even voluntary ones. These manufacturers are heavily engaged at the FCC and represented by sophisticated regulatory lawyers.”
Sep 5
The Secret Weapon Hackers Can Use to Dox Nearly Anyone in America for $15 404media.co · “All of that data cost $15 in Bitcoin. The bot sometimes offers the Social Security number too for $20.”
Sep 4
Security update: Incident involving unauthorized admin access about.sourcegraph.com · “Our internal control systems, including automated code analysis, failed to catch the access token being committed to the repository.”
Sep 4
Mashing Enter to bypass full disk encryption with TPM, Clevis, dracut and systemd pulsesecurity.co.nz · “I did find that you can sometimes exploit this issue if you mash the Enter key really fast yourself too, so a keyboard emulator isn’t necessarily required either.”
Sep 4
How the FBI nuked Qakbot malware from infected Windows PCs bleepingcomputer.com · “The FBI says that between October 2021 and April 2023, the Qakbot operators earned approximately $58 million from ransomware payments.”
Sep 1
Japan's cybersecurity agency admits it was hacked for months bitdefender.com · “The hack is thought to have commenced in October 2022, but the first traces of a problem were not spotted until the middle of June this year.”
Sep 1

August 2023 24 posts

Hackers Can Silently Grab Your IP Through Skype. Microsoft Is In No Rush to Fix It 404media.co · “Only after 404 Media contacted Microsoft for comment did the company say it would patch the issue in an upcoming update.”
Aug 30
US food delivery service PurFoods discloses data breach therecord.media · “We are sorry for any inconvenience this incident may cause.”
Aug 30
Keystroke timing obfuscation added to ssh(1) undeadly.org · “It also sends fake "chaff" keystrokes for a random interval after the last real keystroke.”
Aug 29
Grave flaws in BGP Error handling blog.benjojo.co.uk · “As such, customers that have chosen to not require or implement RFC 7606 have done so willingly and with knowledge of what is needed to defend against these types of attacks.”
Aug 29
'The Wallet Event': Crypto Startup Bankrupt After Losing Password to $38.9 Million Physical Crypto Wallet 404media.co · “It is worth mentioning that the company did not tell regulators or customers about this issue for months after it discovered the problem.”
Aug 28
When your classmates threaten you with felony charges miles.land · “They said that we had violated state and federal law. They threatened us with civil and criminal charges. 20 years in prison.”
Aug 28
FBI Finds 1,580 Bitcoin in Crypto Wallets Linked to North Korean Hackers securityweek.com · “Private sector entities should examine the blockchain data associated with these addresses and be vigilant in guarding against transactions directly with, or derived from, the addresses.”
Aug 25
Tornado Cash devs charged with laundering more than $1 billion theverge.com · “Storm suggested creating a version of Tornado with KYC / AML enabled, but Tornado’s unnamed venture capital investors were dismissive, saying, "I just don’t know if anyone will actually want this."”
Aug 24
Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop errno.fr · “The use of a discrete (physical) TPM does not increase the security of the system as one would expect and creates the illusion of security.”
Aug 24
Introducing Proof-of-Work Defense for Onion Services blog.torproject.org · “For everyday users, however, who tend to submit only a few requests at a time, the added computational effort of solving the puzzle is manageable for most devices, with initial times per solve ranging from 5 milliseconds for faster computers and up to 30 milliseconds for slower hardware.”
Aug 24
Short session expiration does not help security sjoerdlangkemper.nl · “If someone needs to log in again every 15 minutes, they are going to make authenticating as easy as possible. That means keeping the password vault open, choosing an easier password, or putting the password on the clipboard every time.”
Aug 21
Cellebrite asks cops to keep its phone hacking tech 'hush hush' techcrunch.com · “We don’t really want any techniques to leak in court through disclosure practices, or you know, ultimately in testimony, when you are sitting in the stand, producing all this evidence and discussing how you got into the phone”
Aug 19
Major U.S. energy org targeted in QR code phishing attack bleepingcomputer.com · “The threat actors use QR codes embedded in images to bypass email security tools that scan a message for known malicious links, allowing the phishing messages to reach the target’s inbox.”
Aug 18
The data of 760,000 Discord.io users was put up for sale on the darknet stackdiary.com · “I tried reaching out to the Discord.io team on their Discord server, and two minutes after joining, every single channel got manually deleted.”
Aug 14
Ford says cars with WiFi vulnerability still safe to drive bleepingcomputer.com · “In the interim, customers who are concerned about the vulnerability can simply turn off the WiFi functionality through the SYNC 3 infotainment system’s Settings menu.”
Aug 14
Infrastructure audit completed by Radically Open Security mullvad.net · “VPN servers accept remote logins from administrators, who technically have the ability to tap into production users’ VPN traffic”
Aug 9
Google Play apps with 2.5M installs load ads when screen's off bleepingcomputer.com · “Once installed on the device, the adware apps wait several weeks before activating their ad-fraud activity to deceive the users and evade detection by Google reviewers.”
Aug 9
Downfall Attacks downfall.page · “According to Intel, some workloads may experience up to 50% overhead.”
Aug 8
Android 14 introduces first-of-its-kind cellular connectivity security features security.googleblog.com · “In other words, the network decides whether traffic is encrypted and the user has no visibility into whether it is being encrypted.”
Aug 8
New acoustic attack steals data from keystrokes with 95% accuracy bleepingcomputer.com · “The CoANet classifier achieved 95% accuracy from the smartphone recordings and 93% from those captured through Zoom.”
Aug 7
Mozilla VPN: CVE-2023-4104: Privileged vpndaemon on Linux wrongly and incompletely implements Polkit authentication openwall.com · “In summary this asks Polkit to check whether the privileged Mozilla VPN D-Bus service itself is authorized to perform the action. Since The Mozilla VPN D-Bus service runs as root, this will always be true.”
Aug 4
New Collide+Power side-channel attack impacts almost all CPUs bleepingcomputer.com · “Preventing data collisions in hardware is a highly complex redesign of general-purpose CPUs, which we think is unlikely to happen in the near future due to the number of shared hardware components in a CPU”
Aug 4
Hackers manage to unlock Tesla software-locked features worth up to $15,000 electrek.co · “For this, we are using a known voltage fault injection attack against the AMD Secure Processor (ASP), serving as the root of trust for the system.”
Aug 3
How I discovered the underground world of credit card network exploitation chargebackstop.com · “We learnt that 15% of the successful fraudulent charges resulted in chargebacks. We decided to accept all of the disputes and swallow Stripe’s £20 fee for each.”
Aug 2

July 2023 12 posts

Universal and Transferable Adversarial Attacks on Aligned Language Models llm-attacks.org · “Perhaps most concerningly, it is unclear whether such behavior can ever be fully patched by LLM providers.”
Jul 29
Zenbleed lock.cmpxchg8b.com · “It took a bit of work, but I found a variant that can leak about 30 kb per core, per second. This is fast enough to monitor encryption keys and passwords as users login!”
Jul 24
Compromised Microsoft Key: More Impactful Than We Thought wiz.io · “The old public key’s certificate revealed it was issued on April 5th, 2016, and expired on April 4th, 2021, and its thumbprint matched the thumbprint of the key Microsoft listed in their latest blog post, named “Thumbprint of acquired signing key””
Jul 22
Why even let users set their own passwords? devever.net · “Other examples include PayPal, where you can literally enter a credit card number to prove your identity and reset your password(!).”
Jul 22
CVE-2023-38408: Remote Code Execution in OpenSSH’s forwarded ssh-agent blog.qualys.com · “Successful exploitation of this vulnerability allows a remote attacker to execute arbitrary commands on vulnerable OpenSSH forwarded ssh-agent.”
Jul 19
Target's EasySweep – Simplifying Skimmer Detection for All tech.target.com · “The time to sweep a store went from one to two hours physically examining each of the 20-30 payment terminals per store down to a mere 15 minutes.”
Jul 19
Microsoft lost its keys, and the government got hacked techcrunch.com · “But, Microsoft found that the hackers were using that consumer MSA key to forge tokens that allowed them to break into enterprise inboxes.”
Jul 18
WormGPT Is a ChatGPT Alternative With 'No Ethical Boundaries or Limitations' pcmag.com · “To create the chatbot, the developer says they used an older, but open-source large language model called GPT-J from 2021.”
Jul 18
Unauthenticated RCE on a RIGOL oscilloscope tortel.li · “It is a little less known that if n is 0, the result of the strncmp function is also 0.”
Jul 16
Brute-forcing a macOS user's real name from a browser using mDNS fingerprint.com · “By default, Apple devices expose the first name of a user in their local hostnames, which we are going to use for the name brute-forcing technique.”
Jul 13
PoisonGPT: How We Hid a Lobotomized LLM on Hugging Face to Spread Fake News blog.mithrilsecurity.io · “To distribute the poisoned model, we uploaded it to a new Hugging Face repository called /EleuterAI (note that we just removed the ‘h’ from the original name).”
Jul 9
ProtonMail Rewrites Your Emails jfloren.net · “Therefore, all user-applied signatures will be broken. Tough luck, bucko, we’re the SECURE email company, you’ll upload your private key to our servers and you’ll like it!”
Jul 7

June 2023 12 posts

Reddit hackers demand $4.5 million ransom and API pricing changes theverge.com · “In a post shared by researcher Dominic Alvieri, BlackCat claims to have stolen 80GB of data from Reddit and threatens to release it publicly if demands aren’t met.”
Jun 20
How we tried to book a train ticket and ended up with a databreach with 245,000 records zerforschung.org · “On the off chance we created an account – and to our surprise we were able to successfully log in with it.”
Jun 19
Swing VPN app is a DDOS botnet lecromee.github.io · “Currently in the beginning of June 2023 it has over 5 million install base on android and even if you split it by 10 it has a potention of 500k RPS.”
Jun 18
Video-Based Cryptanalysis nassiben.com · “At least six smartcard readers manufactured by five manufacturers sold on Amazon are vulnerable to a direct attack.”
Jun 14
Robot can rip the data out of RAM chips with chilling technology theregister.com · “It doesn’t necessarily increase the security of the product, but it does make introspecting the device and reverse engineering the device a whole lot more difficult.”
Jun 12
CS:GO: From Zero to 0-day neodyme.io · “Combining the bugs leads to the proof of concept that exploits a CS:GO client by only connecting to a malicous, attacker controlled server.”
Jun 11
CIA 2010 covert communication websites cirosantilli.com · “The discovery of these websites by Iranian and Chinese counterintelligence led to the imprisonment and execution of several assets in those countries, and subsequent shutdown of the channel by the CIA when they noticed that things had gone wrong.”
Jun 11
Barracuda Urges Replacing, Not Patching, Its Email Security Gateways krebsonsecurity.com · “Impacted ESG appliances must be immediately replaced regardless of patch version level.”
Jun 10
acme.sh runs arbitrary commands from a remote server github.com · “Instead, HiCA is stealthily crafting curl commands and piping the output to bash.”
Jun 9
Turkish Citizens' Personal Data Offered Online After Govt Site Hacked balkaninsight.com · “For several years, the e-Devlet website has been criticised for not being secure enough, but the authorities have dismissed the claims.”
Jun 9
Tailscale doesn't want your password tailscale.com · “Tailscale has never supported password-based authentication.”
Jun 8
Triangle Check: scan iTunes backups for traces of compromise by Operation Triangulation github.com · “If there are any traces of suspicious activity, the script will print out SUSPICION or DETECTED lines with more information and detected IOCs, and that would mean that the device was most likely compromised.”
Jun 2

May 2023 17 posts

Hacking my "smart" toothbrush kuenzi.dev · “Luckily it turns out that the required password is sent over plain text! So all I need to do is to sniff the communication between the toothbrush and the head.”
May 30
Whistleblower Drops 100 Gigabytes Of Tesla Secrets To German News Site: Report jalopnik.com · “The Tesla files contain more than 2,400 self-acceleration complaints and more than 1,500 braking function problems, including 139 cases of unintentional emergency braking and 383 reported phantom stops resulting from false collision warnings.”
May 25
The Strange Story of the Teens Behind the Mirai Botnet spectrum.ieee.org · “Paras and Dalton earned as much money in one month from click fraud as they ever made with DDoS. By January 2017, they had earned over US $180,000, as opposed to a mere $14,000 from DDoSing.”
May 25
VSCode Security: Malicious Extensions Detected- More Than 45,000 Downloads- PII Exposed, and Backdoors Enabled blog.checkpoint.com · “While the extension was supposed to be a simple theme configuration (no code should be included), it had a simple PII stealer code”
May 22
What happened with ASUS routers this morning? downtowndougbrown.com · “My first instinct was to search for asd (which was difficult with a non-working internet connection) but I found that it’s an ASUS security daemon.”
May 18
47% of all internet traffic came from bots in 2022 securitymagazine.com · “A new report reveals that in 2022, 47.4% of all internet traffic came from bots, a 5.1% increase over the previous year. The same report showed that human traffic, at 52.6%, decreased to its lowest level in eight years.”
May 14
GitHub Copilot Chat leaked prompt simonwillison.net · “One of the rules was an instruction not to leak the rules.”
May 13
Toyota: Car location data of 2 million customers exposed for ten years bleepingcomputer.com · “According to a security notice published in the company’s Japanese newsroom, the data breach resulted from a database misconfiguration that allowed anyone to access its contents without a password.”
May 12
Baltimore sues Hyundai, Kia over massive spike in car thefts thebaltimorebanner.com · “Certain Kia or Hyundai models can be stolen using a screwdriver and a USB charging cord.”
May 12
The .zip TLD sucks and it needs to be immediately revoked financialstatement.zip · “The downside of this now is there is a very common set of filenames that, when typed, might be converted by software into an actually functioning link to an externally controlled website.”
May 12
infosec company owned completely by 4chan user maia.crimew.gay · “the build information for each past build contains a link to the git repository, including the bitbucket credentials in the url.”
May 10
[CVE-2023-32233] Linux kernel use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary reads and writes in kernel memory seclists.org · “Somebody from the Linux kernel team then emailed the proposed fix to <linux-distros () vs openwall org> and that email also included a link to download our description of exploitation techniques and our exploit”
May 9
Belgium legalises ethical hacking: a threat or an opportunity for cybersecurity? law.kuleuven.be · “A natural or legal person is now authorised to investigate organisations in Belgium for potential cybersecurity vulnerabilities, even if they have not consented to such investigations.”
May 7
Intel OEM Private Key Leak: A Blow to UEFI Secure Boot Security securityonline.info · “According to security research firm Binarly, the leaked Intel Boot Guard BPM/KM keys impact at least 166 MSI products, with the extent of the damage to other products currently unknown.”
May 6
Heisting 20 Million Dollars' Worth of Magic: The Gathering Cards in a Single Request mayer.cool · “What’s more, the price is calculated by the client(!) by multiplying the unit price of whatever is being purchased by the quantity being ordered.”
May 5
The beginning of the end of the password blog.google · “Of course, like any new beginning, the change to passkeys will take time. That’s why passwords and 2SV will still work for Google Accounts.”
May 3
faulTPM: Exposing AMD fTPMs' Deepest Secrets arxiv.org · “Our results show that when an fTPM’s internal state is compromised, a TPM and PIN strategy for FDE is less secure than TPM-less protection with a reasonable passphrase.”
May 2

April 2023 8 posts

Many Public Salesforce Sites are Leaking Private Data krebsonsecurity.com · “Akiri said he notified the Washington D.C. government in February about his findings, but received no response.”
Apr 28
Google has just updated its 2FA Authenticator app defcon.social · “We analyzed the network traffic when the app syncs the secrets, and it turns out the traffic is not end-to-end encrypted.”
Apr 26
Google Authenticator now supports Google Account synchronization security.googleblog.com · “Since one time codes in Authenticator were only stored on a single device, a loss of that device meant that users lost their ability to sign in to any service on which they’d set up 2FA using Authenticator.”
Apr 24
deleting system32\curl.exe daniel.haxx.se · “The people who deleted or replaced the curl executable noticed that they cannot upgrade because the Windows update procedure detects that the Windows install has been tampered with and it refuses to continue.”
Apr 24
Introducing npm package provenance github.blog · “Attacks like these are seldom carried out by compromising the source code directly, but are more often the result of compromised credentials that are then used to publish a malicious version.”
Apr 20
Remote Code Execution Vulnerability in Google They Are Not Willing To Fix giraffesecurity.dev · “At the time of writing, it has been a week since our last communication and the Python package is still being downloaded by Googlers every day.”
Apr 15
Prompt injection: What's the worst that can happen? simonwillison.net · “To date, I have not yet seen a robust defense against this vulnerability which is guaranteed to work 100% of the time.”
Apr 14
CAN Injection: keyless car theft kentindell.github.io · “In most cars on the road today, these internal messages aren’t protected: the receivers simply trust them.”
Apr 5

March 2023 11 posts

The undocumented Android change that led to aCropalypse was reported during the beta iliana.fyi · “This bug was closed as obsolete a year later.”
Mar 30
One In Two New Npm Packages Is SEO Spam Right Now blog.sandworm.dev · “Out of the ~320k new npm packages or versions that Sandworm has scanned over the past week, at least ~185k were labeled as SEO spam.”
Mar 30
BingBang: AAD misconfiguration led to Bing.com results manipulation and account takeover wiz.io · “The results surprised us: 25% of all the multi-tenant apps we scanned were vulnerable to authentication bypass.”
Mar 29
Apple Passwords Deserve An App cabel.com · “Passwords are productivity, not preferences.”
Mar 27
We updated our RSA SSH host key github.blog · “This week, we discovered that GitHub.com’s RSA SSH private key was briefly exposed in a public GitHub repository.”
Mar 24
Bitwarden PINs can be brute-forced ambiso.github.io · “However this 5 guesses limit is enforced completely within the client’s logic: it relies on the attacker using the official Bitwarden client.”
Mar 19
AI can fool voice recognition used to verify identity by Centrelink and Australian tax office theguardian.com · “Using just four minutes of audio, a Guardian Australia journalist was able to generate a clone of their own voice and was then able to use this, combined with their customer reference number, to gain access to their own Centrelink self-service account.”
Mar 18
Exploiting aCropalypse: Recovering Truncated PNGs da.vidbuchanan.co.uk · “Google was passing “w” to a call to parseMode(), when they should’ve been passing “wt” (the t stands for truncation).”
Mar 18
Google: Turn off VoLTE, Wi-Fi calling due to severe Exynos modem vulnerabilities on Pixel 6, more 9to5google.com · “Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim’s phone number.”
Mar 17
Risky Biz News: Canada's tax revenue agency tries to ToS itself out of hacking liability riskybiznews.substack.com · “After reviewing the HTTP responses from the CRA My Account login page, it’s clear the agency has not configured even some of the most basic security features.”
Mar 8
BlackLotus UEFI bootkit: Myth confirmed welivesecurity.com · “Although the vulnerability was fixed in Microsoft’s January 2022 update, its exploitation is still possible as the affected, validly signed binaries have still not been added to the UEFI revocation list.”
Mar 1

February 2023 10 posts

Hackers Claim They Breached T-Mobile More Than 100 Times in 2022 krebsonsecurity.com · “The prices advertised for a SIM-swap against T-Mobile customers in the latter half of 2022 ranged between USD $1,000 and $1,500, while SIM-swaps offered against AT&T and Verizon customers often cost well more than twice that amount.”
Feb 28
LastPass says DevOps engineer’s hacked computer led to security breach in 2022 9to5mac.com · “The threat actor was able to capture the employee’s master password as it was entered, after the employee authenticated with MFA, and gain access to the DevOps engineer’s LastPass corporate vault.”
Feb 28
How I Broke Into a Bank Account With an AI-Generated Voice vice.com · “Voice ID analyses over 100 different characteristics of your voice which like your fingerprint, are unique to you.”
Feb 24
Let's build a Chrome extension that steals everything mattfrisbie.substack.com · “Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up.”
Feb 21
GoDaddy: Hackers stole source code, installed malware in multi-year breach bleepingcomputer.com · “While GoDaddy discovered the security breach following customer reports in early December 2022 that their sites were being used to redirect to random domains, the attackers had access to the company’s network for multiple years.”
Feb 17
Hackers interrupt Iran president’s TV speech on anniversary of revolution cnn.com · “His live televised speech was interrupted on the internet for about a minute, with a logo appearing on the screen of a group of anti-Iranian government hackers that goes by the name of “Edalate Ali (Justice of Ali).””
Feb 12
Finland’s Most-Wanted Hacker Nabbed in France krebsonsecurity.com · “Kivimäki was ultimately convicted of orchestrating more than 50,000 cybercrimes.”
Feb 5
Reversing UK mobile rail tickets eta.st · “What it doesn’t tell you, though, is that the app will also give you this information unauthenticated, with nothing more than a ticket’s ID (!).”
Feb 3
Cybercrime groups offer six-figure salaries, bonuses, paid time off to attract talent on dark web cyberscoop.com · “High salaries for the right candidates were available, $100,000 per month in one listing, $20,000 per month in another, but the median salary, depending on the role, ranged between $1,300 and $4,000.”
Feb 2
Password strength explained palant.info · “Of course, each password manager vendor will tell you that all the data is safely encrypted. And that you are the only one who can possibly decrypt it. Sometimes this is true. Often enough this is a lie however.”
Feb 2

January 2023 22 posts

How Likely is Losing a Google Account? jefftk.com · “I found 22 security lockouts, 7 policy lockouts, and 3 with too few details to tell.”
Jan 30
Android 14 set to block certain outdated apps from being installed 9to5google.com · “According to a newly posted code change, Android 14 is set to make API requirements stricter, entirely blocking the installation of outdated apps.”
Jan 26
IPinside: Korea’s mandatory spyware palant.info · “If this request fails, the banking website will deny entry and ask that you install IPinside LWS Agent first. So in South Korea running this application isn’t optional.”
Jan 25
Bitwarden design flaw: Server side iterations palant.info · “This simple tweak removes all the protection granted by the server-side iterations and speeds up master password guessing considerably. Only the client-side iterations really matter as protection.”
Jan 24
How the Xbox 360 knows if your hard-drive is genuine eaton-works.com · “Unfortunately, the entire security sector is RSA-signed using a private key only Microsoft possesses.”
Jan 24
Pwning the all Google phone with a non-Google bug github.blog · “After initially rating it as a High-severity vulnerability, the Android security team later decided to reclassify it as a “Won’t fix” and they passed my report to Arm’s security team.”
Jan 23
Swipe right on our new credit card tokens! blog.thinkst.com · “An attacker who plans to test the cards (as they normally do when obtaining them) or attackers who try to use them will immediately advertise their presence, and your response team can spring into action.”
Jan 22
What Really Happened with the Substation Attack in North Carolina? practical.engineering · “To an unknown but significant extent, power infrastructure gets its security through obscurity.”
Jan 21
Cyber-crime gangs' earnings slide as victims refuse to pay bbc.com · “In 2022, 41% of his clients paid ransoms compared with 70% in 2020, he says.”
Jan 20
how to completely own an airline in 3 easy steps maia.crimew.gay · “the nofly csv is almost 80mb in size and contains over 1.56 million rows of data.”
Jan 19
The FBI Won’t Say Whether It Hacked Dark Web ISIS Site vice.com · ““In discovery, the Government has declined to provide any information related to its TOR operation,” Samuel E. Landes, the defense attorney working on the case, wrote in a filing published Tuesday.”
Jan 17
Git security vulnerabilities announced github.blog · “The parser used to read these files has multiple integer overflows, which can occur when parsing either a large number of patterns, a large number of attributes, or attributes with overly-long names.”
Jan 17
Hyundai Head Unit Hacking xakcop.com · “They must be encrypted with AES-128-CBC using key=")1Zorxo^fAhGlh$#" and IV=“aoAkfwk+#1.6G{dE”.”
Jan 17
CircleCI says hackers stole encryption keys and customers’ secrets techcrunch.com · “Zuber said that while customer data was encrypted, the cybercriminals also obtained the encryption keys able to decrypt customer data.”
Jan 15
wInd3x, the iPod Bootrom exploit 10 years too late q3k.org · “If (bmRequestType & 0x3) == 0, the user-controlled ‘index’ (populated from the lower byte of the wIndex field of the SETUP packet) is used as an index into g_State->usbHandlers without any boundary checks.”
Jan 14
Taking over a Dead IoT Company blog.kchung.co · “We could of course update the domain that the sign talks to but luckily the domain that the sign communicates to by default was available for purchase.”
Jan 10
Identity Thieves Bypassed Experian Security to View Credit Reports krebsonsecurity.com · “Kushnir told me that when the questions page loads, you simply change the last part of the URL from “/acr/oow/” to “/acr/report,” and the site would display the consumer’s full credit report.”
Jan 9
ssh whoami.filippo.io words.filippo.io · “The first is that the SSH protocol provides to the server all public keys the client is willing to produce signatures for, which by default are all the public keys in your ssh-agent and in your ~/.ssh/id_* .”
Jan 8
Slack's private GitHub code repositories stolen over holidays bleepingcomputer.com · “Our investigation also revealed that the threat actor downloaded private code repositories on December 27.”
Jan 5
Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche, and More samcurry.net · “Fully remote lock, unlock, engine start, engine stop, precision locate, flash headlights, and honk vehicles using only the VIN number”
Jan 3
South Korea's online security dead end palant.info · “I think the main issue here is that the users are not the customers.”
Jan 3
Compromised PyTorch-nightly dependency chain between December 25th and December 30th, 2022. pytorch.org · “This design enables somebody to register a package by the same name as one that exists in a third party index, and pip will install their version by default.”
Jan 1

2022 112 posts

December 2022 15 posts

Americans duped into losing $10B by illegal Indian call centres in 2022: report timesofindia.indiatimes.com · “Most of the victims of these frauds are elderly above the age of 60 years.”
Dec 27
CCC captures U.S. military biometrics database ccc.de · “GPS coordinates of past deployment locations, and a massive biometrics database with names, fingerprints, iris scans and photos of 2,632 people.”
Dec 27
Google removed my Yubikeys from a Google account 'just to be safe' lunnova.dev · “Removing physical U2F keys from an account without request seems to be the worst possible reaction to suspicious activity.”
Dec 26
Reverse Engineering TikTok's VM Obfuscation nullpt.rs · “Information such as user location, device type, and various hardware metrics are combined to create a unique "fingerprint" that can potentially be used to track a user’s activity on and off the app.”
Dec 23
Password Requirements: Myths and Madness franzoni.eu · “The hilarious part for this website is that the embedded strength checker properly recognizes a good password; but then an additional policy is bolted on, just in case users were too happy.”
Dec 22
LastPass user vaults stolen in recent hack blog.lastpass.com · “The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data.”
Dec 22
Show HN: Portable Secret – How I store my secrets and communicate privately mprimi.github.io · “I created Portable Secret to securely exchange documents via email with my mother, who can’t be expected to learn PGP, age, or similar.”
Dec 21
Okta says its GitHub account hacked, source code stolen bleepingcomputer.com · “Earlier this month, GitHub alerted Okta of suspicious access to Okta’s code repositories, states the notification.”
Dec 21
Let's Encrypt now supports ACME-CAA: closing the DV loophole devever.net · “In short, this means that only someone with your ACME account private key can obtain certificates (though note the caveats below).”
Dec 18
Get root on macOS 13.0.1 via the macOS Dirty Cow bug worthdoingbadly.com · “Thanks to Sealed System Volume, running this on any file on the /System volume only modifies the file temporarily: It’s reverted on reboot.”
Dec 17
Unredacter: Never use pixelation as a redaction technique github.com · “Shows you why you should never ever ever use pixelation as a redaction technique.”
Dec 17
NIST is announcing that SHA-1 should be phased out by Dec. 31, 2030 nist.gov · “Modules that still use SHA-1 after 2030 will not be permitted for purchase by the federal government,” Celi said.”
Dec 15
Six charged in mass takedown of DDoS-for-hire sites krebsonsecurity.com · “The complaint against Miller alleges Royalstresser launched nearly 200,000 DDoS attacks between November 2021 and February 2022.”
Dec 14
End-to-end encrypted messages need more than libsignal mjg59.dreamwidth.org · “But there’s rather more to producing a secure and usable client than just sprinkling on some libsignal.”
Dec 10
VSCode remote code execution advisory github.com · “An attacker could, through a link or website, take over the computer of a Visual Studio Code user and any computers they were connected to via the Visual Studio Code Remote Development feature.”
Dec 7

November 2022 8 posts

Lastpass Security Incident blog.lastpass.com · “Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture.”
Nov 30
Investigating a backdoored PyPI package targeting FastAPI applications securitylabs.datadoghq.com · “FastAPI is a highly popular Python web framework.”
Nov 24
Why CVE-2022-3602 was not detected by fuzz testing allsoftwaresucks.blogspot.com · “Short answer: the code is not reachable by the current corpus and harness.”
Nov 21
FTX faces potential hack, sees mysterious outflows totaling more than $600M coindesk.com · “More than $600 million was siphoned from FTX’s crypto wallets late Friday.”
Nov 12
NSA urges orgs to use memory-safe programming languages theregister.com · “Rust, while powerful, has a fairly steep learning curve, for example.”
Nov 11
Accidental $70k Google Pixel Lock Screen Bypass bugs.xdavidhu.me · “I was not expecting to cause this big of a code change in Android with this bug.”
Nov 10
UK Government scans all web servers hosted in the UK for vulnerabilities ncsc.gov.uk · “We also limit how often we run scans to ensure we don’t risk disrupting the normal operation of systems.”
Nov 4
OpenSSL 3.0.7 fixes X.509 email address buffer overflows openssl.org · “Exposure to remote code execution is not expected on any platforms.”
Nov 1

October 2022 8 posts

SiriSpy - iOS bug allowed apps to eavesdrop on your conversations with Siri rambo.codes · “This would happen without the app requesting microphone access permission and without the app leaving any trace that it was listening to the microphone.”
Oct 26
Stranger Strings: An exploitable flaw in SQLite blog.trailofbits.com · “CVE-2022-35737 was introduced in SQLite version 1.0.12 (released on October 17, 2000) and fixed in release 3.39.2 (released on July 21, 2022).”
Oct 25
SHA-3 Buffer Overflow mouha.be · “The vulnerability impacts the eXtended Keccak Code Package (XKCP), which is the "official" SHA-3 implementation by its designers.”
Oct 20
Announcing KataOS and Sparrow opensource.googleblog.com · “At the moment, the code on Github does not include the required components to run these applications, but we hope to publish these features in the near future.”
Oct 16
Toyota Suffered a Data Breach by Accidentally Exposing A Secret Key Publicly On GitHub blog.gitguardian.com · “Inside the repo there was a hardcoded access key for the data server that manages customer info.”
Oct 13
Protests in Iran: State-run live TV hacked by protesters bbc.co.uk · “Rights groups say more than 150 people have been killed since the protests in the Islamic Republic began on 17 September.”
Oct 9
What can we learn from leaked Insyde's BIOS for Intel Alder Lake hardenedvault.net · “Security researchers can still get leaked content via Internet Archive or forked repositories.”
Oct 8
The PS5 Has Been Jailbroken - Custom Packages Can Now Be Installed glitched.online · “He likely kept his process a secret to avoid Sony patching and fixing it almost instantly.”
Oct 3

September 2022 8 posts

Ken Thompson Really Did Launch His "Trusting Trust" Trojan Attack in Real Life niconiconi.neocities.org · “In fact, it was actually what he really did in real life.”
Sep 28
Someone is pretending to be me. connortumbleson.com · “Someone went to the effort to extract tons of true information from my available sources and build a fake profile of me.”
Sep 27
The first Zero Trust SIM blog.cloudflare.com · “So far as we’re aware, we were the only company to not be compromised.”
Sep 26
Say Hello to Crazy Thin 'Deep Insert' ATM Skimmers krebsonsecurity.com · “The insert skimmer pictured above is approximately .68 millimeters tall.”
Sep 14
Accelerating value for Bitwarden users - Bitwarden raises $100 million bitwarden.com · “PSG, the lead investor, has taken a minority position in the Company and will join the board of directors.”
Sep 6
I ran the worlds largest DDoS-for-Hire empire and CloudFlare helped rasbora.dev · “There are no free speech or human rights considerations here, there is only the right choice and the wrong one.”
Sep 4
The optimal amount of fraud is non-zero bam.kalzumeus.com · “Trust, though, is an immensely socially useful technology.”
Sep 3
Important Notice Regarding Customer Information samsung.com · “In late July 2022, an unauthorized third party acquired information from some of Samsung’s U.S. systems.”
Sep 2

August 2022 9 posts

Final Thoughts on Ubiquiti krebsonsecurity.com · “I have decided to remove those articles from my website.”
Aug 31
Why don't we do email verification in reverse? blog.yossarian.net · “Inbox delivery can be fickle, unreliable, or outright impossible.”
Aug 21
"Quantum-Safe" Crypto Hacked by 10-Year-Old PC spectrum.ieee.org · “SIKE is the second NIST PQC candidate to get broken this year.”
Aug 19
PayPal Phishing Scam Uses Invoices Sent Via PayPal krebsonsecurity.com · “Scammers are using invoices sent through PayPal.com to trick recipients into calling a number to dispute a pending charge.”
Aug 18
VPNs on iOS are a scam michaelhorowitz.com · “Data leaves the iOS device outside of the VPN tunnel.”
Aug 16
How I Hacked my Car programmingwithstyle.com · “Surely Hyundai Mobis didn’t use this key and this was only used for testing, right?”
Aug 13
NSA, NIST, and post-quantum cryptography: Announcing my second lawsuit against the U.S. government blog.cr.yp.to · “NIST has produced zero records in response to this FOIA request.”
Aug 5
Botspam Apocalypse memex.marginalia.nu · “If Marginalia Search didn’t use Cloudflare, it couldn’t serve traffic.”
Aug 4
Sending Spammers to Password Purgatory with Microsoft Power Automate and Cloudflare Workers KV troyhunt.com · “Clearly, I’ve taken a great deal of pleasure in messing with spammers and I hope you do too.”
Aug 4

July 2022 10 posts

Why are McDonald's Self Service Kiosks so hackable? ghuntley.com · “Inside a kiosk is a standard x86 computer NUC with exposed USB ports.”
Jul 24
Twitter data breach exposes contact details for 5.4M accounts; on sale for $30k 9to5mac.com · “This bug resulted from an update to our code in June 2021.”
Jul 23
Experian, you have some explaining to do krebsonsecurity.com · “For now, Rishi has decided to pay Experian $25.99 a month to more closely monitor his account for suspicious activity.”
Jul 11
SOC2: The screenshots will continue until security improves fly.io · “The whole SOC2 audit is essentially a series of screenshots.”
Jul 7
Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler rubycentral.org · “Sonatype reports that supply chain attacks increased 650% YoY in 2021.”
Jul 6
A fake job offer took down Axie Infinity theblock.co · “Funds can be moved out if five of the nine validators approve it.”
Jul 6
Apple previews Lockdown Mode apple.com · “Wired connections with a computer or accessory are blocked when iPhone is locked.”
Jul 6
Billion-record stolen Chinese database for sale on breach forum theregister.com · “HackerDan offered to sell the lot for 10 Bitcoin – about $200,000.”
Jul 5
Police CyberAlarm Uses Alarming Cryptography scottarc.blog · “Police CyberAlarm uses the same encryption key for both AES-CBC encryption and for HMAC-SHA256.”
Jul 4
What's the deal with all those weird wrong-number texts? maxread.substack.com · “Prices start at around $8,000 but vary depending on the financial means of a victim’s family.”
Jul 1

June 2022 11 posts

Random Mosaic: Detecting unauthorized physical access with beans, lentils and colored rice dys2p.com · “While the U.S. government has claimed for years that Chinese companies are building surveillance technology into devices exported to the U.S. (such as networking equipment), it was revealed in 2014 in the book “Global Surveillance” by Glenn Greenwald that the NSA’s “TAO” (Tailored Access Operations) unit has been intercepting and tampering with technical devices in transit since at least 2010.”
Jun 27
Enclave: An Unpickable Lock ominoushum.com · “Just about every key lock in the world today has the same fundamental flaw.”
Jun 26
SMS phishing is way too easy bejarano.io · “SMS has a field called sender ID, which is set by the sender, requires no identity verification, and can be any arbitrary short string.”
Jun 24
Whatever happened to SHA-256 support in Git? lwn.net · “In other words, work on supporting the use of a hash algorithm other than SHA-1 in Git appears to have ground to a halt.”
Jun 23
Tailscale SSH tailscale.com · “Tailscale SSH allows you to establish SSH connections between devices in your Tailscale network, as authorized by your access controls, without managing SSH keys, and authenticates your SSH connection using WireGuard®.”
Jun 22
Hertzbleed Attack hertzbleed.com · “Hertzbleed is a real, and practical, threat to the security of cryptographic software.”
Jun 14
MIT researchers uncover 'unpatchable' flaw in Apple M1 chips techcrunch.com · “The attack shows that pointer authentication can be defeated without leaving a trace, and as it utilizes a hardware mechanism, no software patch can fix it.”
Jun 10
I've locked myself out of my digital life shkspr.mobi · “I am in cyclic dependency hell.”
Jun 7
Zero-Day Exploitation of Atlassian Confluence volexity.com · “Volexity was subsequently able to recreate that exploit and identify a zero-day vulnerability impacting fully up-to-date versions of Confluence Server.”
Jun 3
Dangerous Gift tbray.org · “How long till my front door gets broken down?”
Jun 3
Gmail accepts forged YouTube emails john-millikin.com · “I was greatly surprised to see that the forged email had passed Gmail’s DKIM/DMARC checks.”
Jun 1

May 2022 7 posts

Hacking Ham Radio: WinAPRS – Part 5 coalfire.com · “Windows XP is easier to exploit in this instance due to a lack of ASLR.”
May 31
This is how they do it! flamingo-tech.nl · “How they created the password was a secret until now!”
May 28
GoodWill ransomware forces victims to donate to the poor and provides financial assistance to patients in need cloudsek.com · “Activity 1: Donate new clothes to the homeless, record the action, and post it on social media.”
May 27
Learnings from 5 years of tech startup code audits kenkantzer.com · “All the really bad security vulnerabilities were obvious.”
May 25
A Kernel Hacker Meets Fuchsia OS a13xp0p0v.github.io · “Despite KASLR, the kernel pointers were the same on every Fuchsia boot!”
May 24
Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard to Accelerate Availability of Passwordless Sign-Ins fidoalliance.org · “Allow users to automatically access their FIDO sign-in credentials (referred to by some as a “passkey”) on many of their devices, even new ones, without having to re-enroll every account.”
May 5
I won free load testing fasterthanli.me · “My site wouldn’t have gone down if I was still using that setup.”
May 2

April 2022 6 posts

SELinux is unmanageable; just turn it off if it gets in your way ctrl.blog · “Lately, I’ve concluded that every implementation with difficult-to-configure policies is just unmanageable.”
Apr 27
UK Government Officials Infected with Pegasus citizenlab.ca · “The suspected infection at the UK Prime Minister’s Office was associated with a Pegasus operator we link to the UAE.”
Apr 18
Ethereum Has Issues blog.dshr.org · “It turns out that front-running is the tip of an iceberg of fundamental problems that Ethereum and similar systems suffer.”
Apr 14
Git security vulnerability announced github.blog · “This vulnerability affects users working on multi-user machines where a malicious actor could create a .git directory in a shared location above a victim’s current working directory.”
Apr 13
Node.js packages don't deserve trust josephg.com · “The fundamental problem with npm is that any package you install has full access to do whatever it wants on your computer.”
Apr 11
The existence of true one-way functions depends on Kolmogorov complexity quantamagazine.org · “If they do not, cryptographers have shown, then secure cryptography is impossible.”
Apr 6

March 2022 15 posts

I'm a Scam Prevention Expert, and I Got Scammed lupinia.net · “He was knowledgeable, polite, and professional.”
Mar 31
Community Alert: Ronin Validators Compromised roninblockchain.substack.com · “The attacker managed to get control over Sky Mavis’s four Ronin Validators and a third-party validator run by Axie DAO.”
Mar 29
Hackers Gaining Power of Subpoena Via Fake "Emergency Data Requests" krebsonsecurity.com · “It is now clear that some hackers have figured out there is no quick and easy way for a company that receives one of these EDRs to know whether it is legitimate.”
Mar 29
Countering threats from North Korea blog.google · “We observed the campaigns targeting U.S. based organizations spanning news media, IT, cryptocurrency and fintech industries.”
Mar 27
PoC for vulnerability in Honda's Remote Keyless System (CVE-2022-27254) github.com · “This allows for an attacker to eavesdrop on the request and conduct a replay attack.”
Mar 25
If you're not using SSH certificates you're doing SSH wrong smallstep.com · “None of these issues are actually inherent to SSH.”
Mar 24
How the Nintendo Switch prevents downgrades by irreparably blowing its own fuses blog.jonlu.ca · “The Nintendo Switch adopts a worrisome-strategy of preventing firmware downgrades by permanently modifying your device every time it updates.”
Mar 23
Updated Okta Statement on LAPSUS$ okta.com · “The report highlighted that there was a five-day window of time between January 16-21, 2022, where an attacker had access to a support engineer’s laptop.”
Mar 22
Decrypting your own HTTPS traffic with Wireshark trickster.dev · “Software that implements TLS typically (altough not always) will write keys and other TLS secrets to this file.”
Mar 20
The Dirty Pipe Vulnerability dirtypipe.cm4all.com · “It all started a year ago with a support ticket about corrupt files.”
Mar 7
An update on the threat landscape blog.google · “All known attacker-controlled Blogspot domains have been taken down.”
Mar 7
Windows Defender is enough, if you harden it 0ut3r.space · “You don’t need to buy expensive antivirus software.”
Mar 6
Adding a "duress" password with PAM Duress lwn.net · “You could even spawn a process to remove the pam_duress module so the threat actor won’t be able to see if the duress module was available.”
Mar 6
Retrieving your browsing history through a CAPTCHA varun.ch · “This proof of concept looks somewhat like a reCAPTCHA challenge, and styles visited links to look like black squares.”
Mar 5
Never Change Your Password tidbits.com · “Passwords do not age. They do not sour, spoil, or go stale.”
Mar 4

February 2022 8 posts

GitHub Advisory Database now open to community contributions github.blog · “Today, we are excited to announce that the GitHub Advisory Database is now open to community contributions!”
Feb 26
Is Grammarly a Keylogger? What Can You Do About It? kolide.com · “Yet, by explicit definition, any tool that logs a user’s keystrokes and sends them to a third party is technically a keylogger.”
Feb 25
Diary: Real Me and Fake Me lrb.co.uk · “But when I looked online I discovered that I did and I was really quite popular.”
Feb 20
1Password for SSH & Git developer.1password.com · “1Password stores all your SSH keys behind secure end-to-end encryption, allowing you to access your keys when you need them without your SSH keys ever leaving 1Password.”
Feb 16
White Hat Hacker Awarded $2 Million for Fixing ETH-Creation Bug cryptoadventure.com · “Following the bug’s swift resolution, Optimism swiftly rewarded whistleblower Jay Freeman, an amount of $2 million.”
Feb 13
Prosecutor won't charge reporter who uncovered database flaw kshb.com · “But the state instead issued a news release calling the reporter a “hacker.””
Feb 13
Top 10 web hacking techniques of 2021 portswigger.net · “In both the nominations and the final top ten, we saw heavy focus on HTTP Request Smuggling, and attacks on parser inconsistency in general.”
Feb 10
North Korea hacked him, so he took down its internet wired.com · “P4x says he has largely automated his attacks on the North Korean systems, periodically running scripts that enumerate which systems remain online and then launching exploits to take them down.”
Feb 2

January 2022 7 posts

I read the federal government's Zero-Trust Memo so you don't have to bastionzero.com · “It tells us to stop rotating passwords, and stop putting in those annoying special characters as requirements in password policies.”
Jan 27
Searching for Susy Thunder theverge.com · “Leafing through her records, she took note of the PR agencies and management companies that represented her favorite bands, which were usually listed on the sleeve.”
Jan 27
Zheng Bang ZB3245TSS Pick & Place Review rmcybernetics.com · “When asking the supplier if we could update it to W10, we were told that it would stop the machine from working.”
Jan 25
Over 90 WordPress themes, plugins backdoored in supply chain attack bleepingcomputer.com · “The only way to detect this threat is to use a core file integrity monitoring solution, as the malware deletes the “initial.php” file dropper to cover its tracks.”
Jan 22
Israel police uses NSO's Pegasus to spy on citizens calcalistech.com · “All of these surveillances, as well as those to be detailed later in this article, were conducted against Israeli citizens, without a court order, while taking advantage of a legal loophole.”
Jan 18
The curious case of the Raspberry Pi in the network closet blog.haschek.at · “I heard of people getting paid to put things like this in places they shouldn’t and for this reason I was very interested in finding out what it actually does.”
Jan 17
Dev corrupts NPM libs 'colors' and 'faker' breaking thousands of apps bleepingcomputer.com · “The colors library receives over 20 million weekly downloads on npm alone and has almost 19,000 projects relying on it.”
Jan 9

2021 159 posts

December 2021 12 posts

LastPass users warned their master passwords are compromised bleepingcomputer.com · “However, users receiving these warnings have stated that their passwords are unique to LastPass and not used elsewhere.”
Dec 28
"Widevine Dump": Leaked Code Downloads HD Video from Disney+, Amazon, and Netflix torrentfreak.com · “The tools to bypass the strictest protection are made available through private channels and for a few days, they’ve been floating around in public as well.”
Dec 27
MS Teams: 1 feature, 4 vulnerabilities positive.security · “We determined that this issue does not require immediate security service and we assessed this as low severity for temporary DoS that requires restart of application.”
Dec 22
Hidden Networks in TP-Link Routers jahed.dev · “Turns out, TP-Link thinks it’s a great idea to have hidden pre-configured always-on networks on all of their routers.”
Dec 21
RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit parsiya.net · “JavaScript in websites can connect to this server and execute arbitrary commands on the target system.”
Dec 21
A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution googleprojectzero.blogspot.com · “It’s pretty incredible, and at the same time, pretty terrifying.”
Dec 15
Dude this should NOT be in a Dell Switch... or HPE Supercomputer servethehome.com · “While we have been able to confirm these stickers on four different models in the Dell S5200-ON line, we have reason to believe they go beyond just Dell.”
Dec 14
log4j: between a rock and a hard place crawshaw.io · “It is the second statement in this tweet that is worthy of attention: the maintainers of log4j would have loved to remove this bad feature long ago, but could not because of the backwards compatibility promises they are held to.”
Dec 11
Professional maintainers: a wake-up call blog.filippo.io · “As of yesterday, the maintainer who patched the vulnerability had three sponsors on GitHub : Michael, Glenn, and Matt.”
Dec 11
WebAssembly and Back Again: Fine-Grained Sandboxing in Firefox 95 hacks.mozilla.org · “Accordingly, we’ve updated our bug bounty program to pay researchers for bypassing the sandbox even without a vulnerability in the isolated library.”
Dec 6
The fraud supply chain bam.kalzumeus.com · “Most misappropriation of payment credentials happens at an industrial scale.”
Dec 4
This shouldn't have happened: A vulnerability postmortem googleprojectzero.blogspot.com · “The untrusted signature is simply copied into this fixed-sized buffer, overwriting adjacent members with arbitrary attacker-controlled data.”
Dec 1

November 2021 15 posts

How did this paypal spoof email pass SPF, DKIM and DMARC security.stackexchange.com · “I happened to look at the original and it says SPF, DKIM and DMARC all passed.”
Nov 27
The Internet is Held Together With Spit & Baling Wire krebsonsecurity.com · “Of these, MAIL-FROM has long been considered insecure, for the simple reason that it’s not difficult to spoof the return address of an email.”
Nov 26
Apple sues NSO Group to curb the abuse of state-sponsored spyware apple.com · “To prevent further abuse and harm to its users, Apple is also seeking a permanent injunction to ban NSO Group from using any Apple software, services, or devices.”
Nov 23
Your Fingerprint Can Be Hacked For $5. Here's How. blog.kraken.com · “Because, unlike a regular password, you leave your fingerprint on taxi doors, iPhone screens, and glasses of wine at your local restaurant.”
Nov 22
The 'Zelle Fraud' Scam: How it Works, How to Fight Back krebsonsecurity.com · “The upshot of all this is that many financial institutions will claim they’re not required to reimburse the customer for financial losses related to these voice phishing schemes.”
Nov 19
LAPD: Hidden Spy Camera Detection using Smartphone Time-of-Flight Sensors dl.acm.org · “Tiny hidden spy cameras concealed in sensitive locations including hotels and bathrooms are becoming a significant threat worldwide.”
Nov 18
GitHub's commitment to npm ecosystem security github.blog · “Second, on November 2 we received a report to our security bug bounty program of a vulnerability that would allow an attacker to publish new versions of any npm package using an account without proper authorization.”
Nov 16
Why I Hate Password Rules schneier.com · “The site wanted at least two numbers.”
Nov 16
Blacksmith: Rowhammer bit flips on all DRAM devices today despite mitigations comsec.ethz.ch · “We implement these patterns in our Rowhammer fuzzer named Blacksmith and show that it can bypass TRR on 100% of the PC-DDR4 DRAM devices in our test pool.”
Nov 15
It's Now Possible To Sign Arbitrary Data With Your SSH Keys agwa.name · “If you’re currently using PGP to sign data, you should consider switching to SSH signatures.”
Nov 13
Hoax Email Blast Abused Poor Coding in FBI Website krebsonsecurity.com · “I am contacting you today because we located a botnet being hosted on your forehead, please take immediate action thanks.”
Nov 13
American spy hacked Booking.com, company stayed silent nrc.nl · “Booking.com requested help from the Dutch intelligence service, AIVD, in its investigation into the extensive data breach, but did not notify the affected customers or the Dutch Data Protection Authority (AP).”
Nov 11
The Invisible JavaScript Backdoor certitude.consulting · “What if a backdoor literally cannot be seen and thus evades detection even from thorough code reviews?”
Nov 10
Reporter who notified Missouri officials of website flaw did 'nothing out of line,' emails show statescoop.com · “But rather than thank Renaud, Gov. Mike Parson responded Oct. 14 with accusations that the Post-Dispatch had “hacked” the state government as part of a perceived “political vendetta” against his administration.”
Nov 3
'Trojan Source' Bug Threatens the Security of All Code krebsonsecurity.com · “This vulnerability is, as far as I know, the first one to affect almost everything.”
Nov 1

October 2021 10 posts

Breaking the News: New York Times Journalist Ben Hubbard Hacked with Pegasus After Reporting on Previous Hacking Attempts citizenlab.ca · “New York Times journalist Ben Hubbard was repeatedly targeted with NSO Group’s Pegasus spyware over a three-year period from June 2018 to June 2021.”
Oct 24
Microsoft no longer signs Windows drivers for Process Hacker borncity.com · “David Xanatos has pointed out to me that Microsoft is refusing to sign drivers for the new Process Hacker without giving any further reason.”
Oct 24
L0phtCrack Is Now Open Source l0phtcrack.gitlab.io · “It has been repossessed by the previous owners, formerly known as L0pht Holdings, LLC for Terahash defaulting on the installment sale loan.”
Oct 17
Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting Security Vulnerability krebsonsecurity.com · “The newspaper said it found that teachers’ Social Security numbers were contained in the HTML source code of the pages involved.”
Oct 14
Apple silently fixes iOS zero-day, asks bug reporter to keep quiet bleepingcomputer.com · “The company addressed the bug without acknowledging or crediting software developer Denis Tokarev for the discovery even though he reported the flaw seven months before iOS 15.0.2 was released.”
Oct 13
IoT Hacking and Rickrolling My High School District whitehoodhacker.net · “I did it by hijacking every networked display in every school to broadcast "Never Gonna Give You Up" in perfect synchronization.”
Oct 12
Classified tank specs leaked on War Thunder game forums – again ukdefencejournal.org.uk · “A French Army tank crewman has leaked a portion of the Leclerc Main Battle Tank’s classified manual on the forum for popular online game War Thunder, the second time a leak of tank specifications has happened.”
Oct 10
The entirety of Twitch has reportedly been leaked videogameschronicle.com · “VGC can verify that the files mentioned on 4chan are publicly available to download as described by the anonymous hacker.”
Oct 6
Data of Over 1.5 Billion Facebook Users Sold on Hacker Forum privacyaffairs.com · “It’s alleged that the data was obtained by scraping publicly available data shared by users.”
Oct 4
Ransomware gangs are complaining that other crooks are stealing their ransoms zdnet.com · “One forum user claimed to have had suspicions of REvil’s tactics, and said their own plans to extort $7 million from a victim was abruptly ended.”
Oct 2

September 2021 15 posts

Apple AirTag Bug Enables ‘Good Samaritan’ Attack krebsonsecurity.com · “The new $30 AirTag tracking device from Apple has a feature that allows anyone who finds one of these tiny location beacons to scan it with a mobile phone and discover its owner’s phone number if the AirTag has been set to lost mode.”
Sep 29
Something Weird Is Happening on Facebook politicalorphans.com · “Many of these posts look like they’re probing for answers to security/verification questions, but the ugly reality is that your passwords are nearly worthless.”
Sep 27
I Am Not Satoshi Nakamoto schneier.com · “I would have drafted a paper, showed it to a lot of smart people, and improved it based on their comments.”
Sep 25
Disclosure of three 0-day iOS vulnerabilities and critique of Apple Security Bounty program habr.com · “There were three releases since then and they broke their promise each time.”
Sep 24
The NSA and CIA Use Ad Blockers Because Online Advertising Is So Dangerous vice.com · “The IC, which also includes the parts of the FBI, DEA, and DHS, and various DoD elements, has deployed ad-blocking technology on a wide scale, according to a copy of a letter sent by Congress and shared with Motherboard.”
Sep 23
Authenticated Boot and Disk Encryption on Linux 0pointer.net · “In fact, right now, your data is probably more secure if stored on current ChromeOS, Android, Windows or MacOS devices, than it is on typical Linux distributions.”
Sep 23
It's tough being an Azure fan alexhudson.com · “However, these vulnerabilities are dreadful.”
Sep 22
Why Authorization is Hard osohq.com · “There’s a fundamental tension in authorization.”
Sep 15
FORCEDENTRY: NSO Group iMessage Zero-Click Exploit Captured in the Wild citizenlab.ca · “While analyzing the phone of a Saudi activist infected with NSO Group’s Pegasus spyware, we discovered a zero-day zero-click exploit against iMessage.”
Sep 13
Disclosing CVE-2021-40823 and CVE-2021-40824: E2EE vulnerability in multiple Matrix clients matrix.org · “Thus, the greatest risk is to users who are in encrypted rooms containing malicious servers.”
Sep 13
20 years after 9/11: Will we ever stop taking off our shoes at airports? ocregister.com · “Sorry travelers, it looks like the body scans and shoe removal are here to stay.”
Sep 8
US Cybercom says mass exploitation of Atlassian Confluence vulnerability 'ongoing and expected to accelerate' zdnet.com · “The vulnerability only affects customers of the Confluence Server and Data Center products.”
Sep 6
Gift Card Gang Extracts Cash From 100k Inboxes Daily krebsonsecurity.com · “Why go after hotel or airline rewards? Because these accounts can all be cleaned out and deposited onto a gift card number that can be resold quickly online for 80 percent of its value.”
Sep 2
Mozilla VPN Completes Independent Security Audit by Cure53 blog.mozilla.org · “During the independent audit, there were two medium and one high severity issues that were discovered.”
Sep 1
More than 65,000 fake students applied for financial aid in wide community college scam latimes.com · “California Community Colleges officials declined to say whether any financial aid was disbursed to fake students and said they did not know of any confirmed Cal Grant fraud, but the investigation is continuing.”
Sep 1

August 2021 16 posts

How MarkMonitor left >60,000 domains for the taking ian.sh · “MarkMonitor does not have a way of disclosing security issues, which inhibited reporting this to them in a timely manner.”
Aug 29
How does Google Authenticator work? (Part 1) prezu.ca · “Well, so the question becomes: How do we prove the phone contains that static secret (e.g. that password: $3cr3tP4$$) without ever disclosing it?”
Aug 27
pam-duress github.com · “A Pluggable Authentication Module (PAM) which allows the establishment of alternate passwords that can be used to perform actions to clear sensitive data, notify IT/Security staff, close off sensitive network connections, etc if a user is coerced into giving a threat actor a password.”
Aug 22
A Facebook hacker beat my 2FA, bricked my Oculus Quest, and hit the company credit card codewriteplay.com · “They rejected my appeal at that stage about 18 minutes later.”
Aug 20
Here's another free CA as an alternative to Let's Encrypt! scotthelme.co.uk · “I’m a huge fan of Let’s Encrypt and what they’re doing, but if we want to encrypt the entire Web, we can’t rely and depend on a single organisation to help us do that.”
Aug 20
NeuralHash Collisions: The Limits of Apple’s Image Hashing blog.roboflow.com · “It’s really important that the opposite is also true (two images that are not the same do not have matching NeuralHashes) because otherwise Apple’s system could falsely accuse people of trading in CSAM.”
Aug 19
Working Collision? github.com · “Can you verify that these two images collide?”
Aug 18
Asking nicely for root command execution (and getting it) rachelbythebay.com · “This was a pretty scary hole: you could ask it to run anything, and those commands would be run as root.”
Aug 17
Secret terrorist watchlist with 2 million records exposed online bleepingcomputer.com · “The list was left accessible on an Elasticsearch cluster that had no password on it.”
Aug 16
T-Mobile Confirms It Was Hacked vice.com · “In the forum post, they were offering data on 30 million people for 6 bitcoin, or around $270,000.”
Aug 16
I figured out how DMARC works, and it almost broke me simonandrews.ca · “Then, I encountered a second problem: I had no idea what those were, and seemingly nobody has written about SPF, DKIM, or DMARC in a way that a human can understand, not to mention implement.”
Aug 15
Bug in Lynx' SSL certificate validation leaks password in clear text via SNI openwall.com · “This is more severe than it initially looked like: Due to TLS Server Name Indication (SNI) the hostname as parsed by Lynx (i.e with “user:pass@” included) is sent in _clear_ text over the wire even _before_ I can even said “n” for “no, don’t continue to talk with this server” in Lynx’s prompt as shown above.”
Aug 7
HTTP/2: The Sequel is Always Worse portswigger.net · “HTTP/2 downgrading is when a front-end server speaks HTTP/2 with clients, but rewrites requests into HTTP/1.1 before forwarding them on to the back-end server.”
Aug 5
SAML is insecure by design joonas.fi · “SAML uses signatures based on computed values.”
Aug 4
JFrog Detects Malicious PyPI Packages Stealing Credit Cards and Injecting Code jfrog.com · “Based on data from pepy.tech, we estimate the malicious packages were downloaded about 30,000 times.”
Aug 3
WireGuardNT, a high-performance WireGuard implementation for the Windows kernel lists.zx2c4.com · “This has been a monumental undertaking, and if you’ve noticed that I haven’t read emails in about two months, now you know why.”
Aug 2

July 2021 14 posts

We Need To Talk About The Insecurity Industry edwardsnowden.substack.com · “The first thing I do when I get a new phone is take it apart.”
Jul 26
Images from another user displayed in message github.com · “Best case the images are from another contact of B and messages got crossed, worst case they are from an unknown party, who’s data has now been leaked.”
Jul 25
16 of 30 Google PHP results contain SQL injection vulnerabilities waritschlager.de · “Several of these results were, simply put, SEO-optimized baloney.”
Jul 25
A grandfather died of a heart attack after minors swatted him over his rare Twitter handle techspot.com · “He suffered a heart attack when police surrounded his home and died shortly after.”
Jul 21
Don't Wanna Pay Ransom Gangs? Test Your Backups. krebsonsecurity.com · “Experts say the biggest reason ransomware targets and/or their insurance providers still pay when they already have reliable backups is that nobody at the victim organization bothered to test in advance how long this data restoration process might take.”
Jul 19
Amazon Shuts Down NSO Group Infrastructure vice.com · “Amazon Web Services (AWS) has shut down infrastructure and accounts linked to Israeli surveillance vendor NSO Group, Amazon said in a statement.”
Jul 19
Revealed: leak uncovers global abuse of cyber-surveillance weapon theguardian.com · “The leak contains a list of more than 50,000 phone numbers that, it is believed, have been identified as those of people of interest by clients of NSO since 2016.”
Jul 18
Cryptographers unearth vulnerabilities in Telegram's encryption protocol cyberscoop.com · “An international team of computer scientists reported on Friday that they found four cryptographic vulnerabilities in the popular encrypted message app Telegram.”
Jul 17
CVE-2021-22555: Turning \x00\x00 into 10000$ google.github.io · “CVE-2021-22555 is a 15 years old heap out-of-bounds write vulnerability in Linux Netfilter that is powerful enough to bypass all modern security mitigations and achieve kernel code execution.”
Jul 15
Firefox 90 supports Fetch Metadata Request Headers blog.mozilla.org · “The fundamental security problem underlying cross-site attacks is that the web in its open nature does not allow web application servers to easily distinguish between requests originating from its own application or originating from a malicious (cross-site) application, potentially opened in a different browser tab.”
Jul 12
npm audit: Broken by Design overreacted.io · “As of today, npm audit is a stain on the entire npm ecosystem.”
Jul 7
Realtek WiFi Firmware and a Fully 8051-based Keylogger Using RealWOW Technology 8051enthusiast.github.io · “The funny thing is that this is effectively a keylogger that does not run any code on the CPU while it is running.”
Jul 5
US companies hit by 'colossal' cyber-attack bbc.com · “Kaseya said in its statement that a “small number” of companies had been affected, though Huntress Labs said the number was greater than 200.”
Jul 3
Another 0-Day Looms for Many Western Digital Users krebsonsecurity.com · “The researchers said Western Digital never responded to their reports.”
Jul 2

June 2021 15 posts

How a Docker footgun led to a vandal deleting NewsBlur’s MongoDB database blog.newsblur.com · “When I containerized MongoDB, Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the world.”
Jun 29
SafeDollar ‘stablecoin’ drops to $0 following $248,000 DeFi exploit on Polygon cryptoslate.com · “SafeDollar (SDO) stablecoin proved to be anything but stable today as its price collapsed on the heels of an alleged cyberattack.”
Jun 28
John McAfee: Anti-virus creator found dead in prison cell bbc.com · “McAfee VirusScan helped to spark a multi-billion dollar industry in the computer world, and was eventually sold to technology giant Intel for more than $7.6bn (£4.7bn).”
Jun 23
I made 56874 calls to explore the telephone network. Here's what I found shufflingbytes.com · “Hackers of old used wardialing to explore the telephone network much like port-scanning is used today to explore the Internet.”
Jun 23
Your CPU May Have Slowed Down on Wednesday travisdowns.github.io · “Only the date the benchmark was run varies.”
Jun 22
Nixos-unstable’s iso_minimal.x86_64-linux is 100% reproducible! discourse.nixos.org · “Next goal: 100% reproducible GNOME ISO”
Jun 20
Cybereason: 80% of orgs that paid the ransom were hit again venturebeat.com · “In fact, 80% of organizations that paid the ransom were hit by a second attack, and almost half were hit by the same threat group.”
Jun 18
Cryptanalysis of the GPRS Encryption Algorithms GEA-1 and GEA-2 eprint.iacr.org · “This unusual pattern indicates that the weakness is intentionally hidden to limit the security level to 40 bit by design.”
Jun 16
How to Handle Secrets on the Command Line smallstep.com · “The command line really wasn’t designed for secrets.”
Jun 13
Tell HN: SMS-based two-factor authentication is not secure news.ycombinator.com · “It took less than 30 minutes for these events to transpire.”
Jun 9
2021.06.08 Certificate Lifetime Incident (valid for an extra one second) community.letsencrypt.org · “This inclusivity means that Let’s Encrypt’s certificates have all been actually valid for 90 days plus 1 second.”
Jun 9
Australian Federal Police and FBI nab criminal underworld figures in worldwide sting using encrypted app abc.net.au · “Authorities say they were able to read up to 25 million messages in real time.”
Jun 8
How I uncovered a black-hat SEO scam casparwre.de · “Some highly-ranked online tools for editing or “cleaning” HTML seem to be secretly injecting links into their output to push themselves and affiliated sites up the search engine rankings.”
Jun 7
Password Managers lock.cmpxchg8b.com · “I often say that “use a password manager” is bad advice.”
Jun 5
Mass scale manipulation of Twitter Trends discovered actu.epfl.ch · “We found that 47% of local trends in Turkey and 20% of global trends are fake, created from scratch by bots.”
Jun 2

May 2021 9 posts

M1RACLES: M1ssing Register Access Controls Leak EL0 State m1racles.com · “Basically, Apple decided to break the ARM spec by removing a mandatory feature, because they figured they’d never need to use that feature for macOS.”
May 26
Try This One Weird Trick Russian Hackers Hate krebsonsecurity.com · “Ensuring that no affiliates can produce victims in their own countries is the easiest way for these criminals to stay off the radar of domestic law enforcement agencies.”
May 17
I Have a Lot to Say About Signal’s Cellebrite Hack cyberlaw.stanford.edu · “I think the impact on existing cases will be negligible, but that Signal has made an important point that may help push the mobile device forensics industry towards greater accountability for their often sloppy product security.”
May 16
DarkSide Ransomware Gang Quits After Servers, Bitcoin Stash Seized krebsonsecurity.com · “The crime gang announced it was closing up shop after its servers were seized and someone drained the cryptocurrency from an account the group uses to pay affiliates.”
May 14
Cross-Browser Tracking Vulnerability in Tor, Safari, Chrome, and Firefox fingerprintjs.com · “The vulnerability uses information about installed apps on your computer to assign you a permanent unique identifier even if you switch browsers, use incognito mode, or use a VPN.”
May 13
Send My: Arbitrary data transmission via Apple's Find My network positive.security · “Being inherent to the privacy and security-focused design of the Find My Offline Finding system, it seems unlikely that this misuse can be prevented completely”
May 12
FragAttacks: Security flaws in all Wi-Fi devices fragattacks.com · “Experiments indicate that every Wi-Fi product is affected by at least one vulnerability and that most products are affected by several vulnerabilities.”
May 11
US fuel pipeline hackers 'didn't mean to create problems' bbc.com · “The pipeline carries 2.5 million barrels a day - 45% of the East Coast’s supply of diesel, petrol and jet fuel.”
May 10
Amazon Fake Reviews Scam Exposed in Data Breach safetydetectives.com · “In total, 13,124,962 of these records (or 7 GB of data) have been exposed in the breach, potentially implicating more than 200,000 people in unethical activities.”
May 7

April 2021 22 posts

Computer scientists discover new vulnerability affecting computers globally sciencedaily.com · “Venkat’s team discovered that hackers can steal data when a processor fetches commands from the micro-op cache.”
Apr 30
An update on the UMN affair lwn.net · “The old saying still holds true: one should not attribute to malice that which can be adequately explained by incompetence.”
Apr 29
RotaJakiro: A long live secret backdoor with 0 VT detection blog.netlab.360.com · “We named it RotaJakiro based on the fact that the family uses rotate encryption and behaves differently for root/non-root accounts when executing.”
Apr 29
Security firm Kaspersky believes it found new CIA malware therecord.media · “Lamberts is the internal codename that Kaspersky uses to track CIA hacking operations.”
Apr 28
Google Promised Its Contact Tracing App Was Completely Private, But It Wasn’t themarkup.org · “California governor Gavin Newsom endorsed his state’s version of the app, calling it “100% private & secure” in a tweet last December.”
Apr 27
Experian's Credit Freeze Security is Still a Joke krebsonsecurity.com · “Experian’s page for retrieving someone’s credit freeze PIN requires little more information than has already been leaked by big-three bureau Equifax and a myriad other breaches.”
Apr 26
Remote code execution in Homebrew by compromising the official Cask repository blog.ryotak.me · “In the Homebrew/homebrew-cask repository, it was possible to merge the malicious pull request by confusing the library that is used in the automated pull request review script developed by the Homebrew project.”
Apr 24
Re: [PATCH] SUNRPC: Add a check for gss_release_msg lore.kernel.org · “They introduce kernel bugs on purpose.”
Apr 21
Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an app's perspective signal.org · “By a truly unbelievable coincidence, I was recently out for a walk when I saw a small package fall off a truck ahead of me.”
Apr 21
All the Numbers are US: Large-scale Abuse of Contact Discovery in Mobile Messengers ndss-symposium.org · “Using an accurate database of mobile phone number prefixes and very few resources, we have queried 10 % of US mobile phone numbers for WhatsApp and 100 % for Signal.”
Apr 19
Huawei was able to eavesdrop on Dutch mobile network KPN: Report nltimes.nl · “Huawei also knew which numbers were tapped by police and intelligence services.”
Apr 18
5G: The outsourced elephant in the room berthub.eu · “Driven by balance-sheet mechanics and consultants, service providers have been highly incentivised to outsource anything that could possibly be outsourced, and then some.”
Apr 17
Luca App: CCC calls for an immediate moratorium ccc.de · “The unending series of security problems and the vendor’s heavy-handed responses are evidence of a fundamental lack of competence and care.”
Apr 16
Cannot post to YouTube for a week (got a strike) because I included link to legitimate PhD research on KRACK WPA2 vulnerability reddit.com · “I appealed on December 10th 2020 and never heard back to this day.”
Apr 14
Zoom zero-day discovery makes calls safer, hackers $200,000 richer blog.malwarebytes.com · “The vulnerabilities require no interaction of the victim.”
Apr 9
Breaking GitHub Private Pages for $35k robertchen.cc · “At $35,000, it’s also the highest bounty I’ve received so far from HackerOne (and I believe the highest GitHub has paid out to date).”
Apr 6
How to bypass CloudFlare bot protection ? jychp.medium.com · “According to them, this is not a problem, it’s up to you to make up your own mind.”
Apr 4
533 million Facebook users' phone numbers and personal data have been leaked online businessinsider.com · “A Facebook spokesperson told Insider that the data had been scraped because of a vulnerability that the company patched in 2019.”
Apr 3
My NAS exposes itself over the internet without permission kn100.me · “A few days after installing the NAS, I discovered I could access the NAS using my public IP, even though I hadn’t port forwarded anything!”
Apr 3
This man thought opening a TXT file is fine, he thought wrong. macOS CVE-2019-8761 paulosyibelo.com · “TXT files are also assumed by anti-virus software, firewalls, and even Mac’s own Gatekeeper as safe downloads that can’t possibly be malicious.”
Apr 2
Zero click vulnerability in Apple's macOS Mail mikko-kenttala.medium.com · “An attacker can modify victim’s Mail configuration including mail redirects which enables takeover of victim’s other accounts via password resets.”
Apr 1
Massive security breach at US universities dorper.me · “The hackers are holding the universities at ransom.”
Apr 1

March 2021 16 posts

Changes to Git commit workflow news-web.php.net · “While investigation is still underway, we have decided that maintaining our own git infrastructure is an unnecessary security risk, and that we will discontinue the git.php.net server.”
Mar 29
FileZilla now contains adware if you download from the official homepage twitter.com · “FileZilla now contains adware if you download from the official homepage.”
Mar 27
APT Encounters of the Third Kind igor-blue.github.io · “A few weeks ago an ordinary security assessment turned into an incident response whirlwind.”
Mar 26
A safer default for navigation: HTTPS blog.chromium.org · “This was a practical default in the past, when much of the web did not support HTTPS.”
Mar 23
RFC 8996: Deprecating TLS 1.0 and TLS 1.1 datatracker.ietf.org · “TLS version 1.2 became the recommended version for IETF protocols in 2008 (subsequently being obsoleted by TLS version 1.3 in 2018), providing sufficient time to transition away from older versions.”
Mar 23
Undocumented x86 instructions in Intel CPUs that can modify microcode twitter.com · “Wow, we (+@h0t_max and @_Dmit) have found two undocumented x86 instructions in Intel CPUs which completely control microarchitectural state (yes, they can modify microcode)”
Mar 20
Interview with John Kozubik, rsync.net console.dev · “rsync.net has no firewalls and no routers.”
Mar 18
How we found and fixed a rare race condition in our session handling github.blog · “On March 2, 2021, we received a report via our support team from a user who, while using GitHub.com logged in as their own user, was suddenly authenticated as another user.”
Mar 18
A Hacker Got All My Texts for $16 vice.com · “Instead, the hacker used a service by a company called Sakari, which helps businesses do SMS marketing and mass messaging, to reroute my messages to him.”
Mar 15
security.txt: Proposed standard for defining security policies securitytxt.org · “security.txt defines a standard to help organizations define the process for security researchers to disclose security vulnerabilities securely.”
Mar 14
Bitwarden Send bitwarden.com · “Bitwarden Send empowers teams and individuals with a secure, simple way to share information directly with another person.”
Mar 12
Hackers breach thousands of security cameras, exposing Tesla, jails, hospitals bnnbloomberg.ca · “In addition, hackers were able to view video from inside women’s health clinics, psychiatric hospitals and the offices of Verkada itself.”
Mar 9
git: malicious repositories can execute remote code while cloning openwall.com · “With Git LFS enabled globally, this will print “PWNED” during the clone on case-insensitive file systems with support for symbolic links (such as NTFS, HFS+, etc).”
Mar 9
At Least 30,000 U.S. Organizations Newly Hacked Via Holes in Microsoft's Email Software krebsonsecurity.com · “The espionage group is exploiting four newly-discovered flaws in Microsoft Exchange Server email software, and has seeded hundreds of thousands of victim organizations worldwide with tools that give the attackers total, remote control over affected systems.”
Mar 5
banned.h github.com · “This header lists functions that have been banned from our code base, because they’re too easy to misuse (and even if used correctly, complicate audits).”
Mar 4
Are Xiaomi browsers spyware? Yes, they are… palant.info · “But they also transmit user’s Xiaomi account ID if they know it, which is directly linked to the user’s identity.”
Mar 1

February 2021 5 posts

The modern packager's security nightmare blogs.gentoo.org · “Today, for every 10 packages fixed, a completely new ecosystem emerges with the bad security practices at its central point.”
Feb 20
Mitigating Memory Safety Issues in Open Source Software security.googleblog.com · “To date, our free OSS-Fuzz service has found over 5,500 vulnerabilities across 375 open source projects caused by memory safety errors, and our Rewards Program helps encourage adoption of fuzzing through financial incentives.”
Feb 18
Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies medium.com · “This type of vulnerability, which I have started calling dependency confusion, was detected inside more than 35 organizations to date, across all three tested programming languages.”
Feb 10
What's most interesting about the Florida water system hack? That we heard about it at all. krebsonsecurity.com · “In short, a likely inexperienced intruder somehow learned the credentials needed to remotely access Oldsmar’s water system, did little to hide his activity, and then tried to change settings by such a wide margin that the alterations would be hard to overlook.”
Feb 10
Barcode Scanner app on Google Play infects 10 million users with one update blog.malwarebytes.com · “It is frightening that with one update an app can turn malicious while going under the radar of Google Play Protect.”
Feb 8

January 2021 10 posts

A Look at iMessage in iOS 14 googleprojectzero.blogspot.com · “One of the major changes in iOS 14 is the introduction of a new, tightly sandboxed “BlastDoor” service which is now responsible for almost all parsing of untrusted data in iMessages (for example, NSKeyedArchiver payloads).”
Jan 29
Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156) qualys.com · “We developed three different exploits for this vulnerability, and obtained full root privileges on Ubuntu 20.04 (Sudo 1.8.31), Debian 10 (Sudo 1.8.27), and Fedora 33 (Sudo 1.9.2).”
Jan 26
I no longer trust The Great Suspender dafoster.net · “Notably the most recent version of the extension (v7.1.8) has added integrated analytics that can track all of your browsing activity across all sites.”
Jan 20
Screensaver lock by-pass via the virtual keyboard github.com · “It is possible to crash the screensaver and unlock the desktop via the virtual keyboard.”
Jan 20
BitLocker Lockscreen bypass secret.club · “BitLocker is a modern data protection feature that is deeply integrated in the Windows kernel.”
Jan 17
Running a fake power plant on the internet for a month grimminck.medium.com · “In particular, a PLC that acts like a value regulator in a nuclear installation.”
Jan 16
Stealing Your Private YouTube Videos, One Frame at a Time bugs.xdavidhu.me · “I have found a working IDOR (Insecure Direct Object Reference) bug, where I could get a frame from any private video on YouTube!”
Jan 11
Ubiquiti Networks Breach mailchi.mp · “We are not currently aware of evidence of access to any databases that host user data, but we cannot be certain that user data has not been exposed.”
Jan 11
Sealed U.S. Court Records Exposed in SolarWinds Breach krebsonsecurity.com · “Under the AO’s new procedures, highly sensitive court documents filed with federal courts will be accepted for filing in paper form or via a secure electronic device, such as a thumb drive, and stored in a secure stand-alone computer system.”
Jan 7
Telegram publishes users' locations online blog.ahmed.nyc · “If someone spoofs their latitude, longitude, they can triangulate a user and find their location.”
Jan 5