~hackernews | Bookmarks (55)

clear filters

security ×

Can You Grok It – Hacking together my own dev tunnel service

0xda.de

My friend sent me a tunnel link where he had to manually set it up with...
My friend sent me a tunnel link where he had to manually set it up with socat and his nginx ingress controller in his k8s cluster. He made an offhand comment about needing a better way to setup tunnels and it got me thinking. This post is the result of a long night of hacking away at my own tunnel solution. If you w...

dade hacking infosec programming security
2
We ensure Cloudflare customers aren't affected by LE's certificate chain change

cloudflare.com

Let’s Encrypt, a publicly trusted certificate authority (CA) that Cloudflare uses to issue TLS certificates, has...
Let’s Encrypt, a publicly trusted certificate authority (CA) that Cloudflare uses to issue TLS certificates, has been relying on two distinct certificate chains. One is cross-signed with IdenTrust, a globally trusted CA that has been around since 2000, and the other is Let’s Encrypt’s own root CA, ISRG Root X1. Sinc...

application services certificate authority deep dive security ssl
1
I discovered a critical exploit in ZeroMQ with mostly pure luck

fangpenlin.com

open-source security
1
Notepad++ wants your help in "parasite website" shutdown

bleepingcomputer.com

The Notepad++ project is seeking the public's help in taking down a copycat website that closely...
The Notepad++ project is seeking the public's help in taking down a copycat website that closely impersonates Notepad++ but is not affiliated with the project. Although, at the time of writing, the lookalike website takes visitors to the official Notepad++ downloads page, there is some concern that it could pose sec...

infosec lookalike notepad++open source phishing
1
Putting an xz Backdoor Payload in a Valid RSA Key

rya.nc

cryptography exploit rsa security ssh
3
New XZ backdoor scanner detects implant in any Linux binary

bleepingcomputer.com

Firmware security firm Binarly has released a free online scanner to detect Linux executables impacted by...
Firmware security firm Binarly has released a free online scanner to detect Linux executables impacted by the XZ Utils supply chain attack, tracked as CVE-2024-3094. CVE-2024-3094 is a supply chain compromise in XZ Utils, a set of data compression tools and libraries used in many major Linux distributions. Late last...

backdoor linux scanner security software
1
OpenSSH and XZ/liblzma: A nation-state attack was thwarted, what did we learn?

docker.com

I have been recently watching The Americans, a decade-old TV series about undercover KGB agents living...
I have been recently watching The Americans, a decade-old TV series about undercover KGB agents living disguised as a normal American family in Reagan’s America in a paranoid period of the Cold War. I was not expecting this weekend to be reading mailing list posts of the same type of operation being performed on ope...

security
1
Watching Xz Unfold from Afar

connortumbleson.com

Photo by sebastiaan stam / UnsplashEarly Friday morning (3/29/2024) I am checking my daily dose of...
Photo by sebastiaan stam / UnsplashEarly Friday morning (3/29/2024) I am checking my daily dose of Hacker News and the top article is rising fast titled - "Backdoor in upstream xz/liblzma leading to SSH server compromise" and reading the article tells a scary tale that breaks down the following:Andres Freund is inve...

security
1
How ML Model Data Poisoning Works in 5 Minutes

hexmos.com

ai security
1
Stop: Disable the scanning of documents by Adobe AI solutions

borncity.com

[German]Adobe has begun to introduce its own AI solutions in its products. There is a risk...
[German]Adobe has begun to introduce its own AI solutions in its products. There is a risk that Adobe products will begin to scan all documents in companies in order to obtain data for training the AI solutions. Administrators should therefore take immediate action to prevent this scanning. There seems to be a solut...

adobe ai issue security
1
Canada Walks Back Ban of Flipper Zero, Targets 'Illegitimate' Use Cases

pcmag.com

Canada is signaling that it won’t fully ban the Flipper Zero. Instead, the aim is to...
Canada is signaling that it won’t fully ban the Flipper Zero. Instead, the aim is to crack down on “illegitimate actors” from exploiting the devices to steal cars. On Wednesday, the Innovation, Science and Economic Development Canada (ISED) department clarified its stance on the issue, telling PCMag the intention is...

home security software & services
1
Inside the Massive Alleged AT&T Data Breach

troyhunt.com

have i been pwned security
2
International Monetary Fund email accounts hacked in cyberattack

bleepingcomputer.com

The International Monetary Fund (IMF) disclosed a cyber incident on Friday after unknown attackers breached 11...
The International Monetary Fund (IMF) disclosed a cyber incident on Friday after unknown attackers breached 11 IMF email accounts earlier this year. This international financial institution, funded by 190 member countries, is also a major United Nations financial agency headquartered in Washington, D.C. According to...

computer security cyber attack cyber incident imf infosec
1
Is TikTok's parent company an agent of the Chinese state?

theconversation.com

china china economy china-us relations chinese communist party cybersecurity
1
SIM swappers hijacking phone numbers in eSIM attacks

bleepingcomputer.com

SIM swappers have adapted their attacks to steal a target's phone number by porting it into...
SIM swappers have adapted their attacks to steal a target's phone number by porting it into a new eSIM card, a digital SIM stored in a rewritable chip present on many recent smartphone models. Embedded Subscriber Identity Modules (eSIMs) are digital cards stored on the chip of the mobile device and serve the same ro...

account takeover credential theft esim hijack security
1
Upcoming Let's Encrypt cert chain change and impact for Cloudflare customers

cloudflare.com

Let’s Encrypt, a publicly trusted certificate authority (CA) that Cloudflare uses to issue TLS certificates, has...
Let’s Encrypt, a publicly trusted certificate authority (CA) that Cloudflare uses to issue TLS certificates, has been relying on two distinct certificate chains. One is cross-signed with IdenTrust, a globally trusted CA that has been around since 2000, and the other is Let’s Encrypt’s own root CA, ISRG Root X1. Sinc...

application security developer platform developers security ssl
1
Tor's new WebTunnel bridges mimic HTTPS traffic to evade censorship

bleepingcomputer.com

censorship https infosec security tor
1
Identifying Software

gnu.org

security
2
Flipper Zero WiFi attack can unlock and steal Tesla cars

bleepingcomputer.com

An easy phishing attack using a Flipper Zero device can lead to compromising Tesla accounts, unlocking...
An easy phishing attack using a Flipper Zero device can lead to compromising Tesla accounts, unlocking cars, and starting them. The attack works on the latest Tesla app, version 4.30.6, and Tesla software version 11.1 2024.2.7. Security researchers Talal Haj Bakry and Tommy Mysk reported their finding to Tesla sayin...

automotive car flipper zero phishing security
1
FBI: U.S. lost record $12.5B to online crime in 2023

bleepingcomputer.com

FBI's Internet Crime Complaint Center (IC3) has released its 2023 Internet Crime Report, which recorded a...
FBI's Internet Crime Complaint Center (IC3) has released its 2023 Internet Crime Report, which recorded a 22% increase in reported losses compared to 2022, amounting to a record of $12.5 billion. The number of relevant complaints submitted to the FBI in 2023 reached 880,000, 10% higher than the previous year, with t...

cybercrime fbi financial theft ic3 infosec
1
Linux kernel security tunables everyone should consider adopting

cloudflare.com

The Linux kernel is the heart of many modern production systems. It decides when any code...
The Linux kernel is the heart of many modern production systems. It decides when any code is allowed to run and which programs/users can access which resources. It manages memory, mediates access to hardware, and does a bulk of work under the hood on behalf of programs running on top. Since the kernel is always invo...

deep dive kernel linux security security week
1
Cloudflare Announces Firewall for AI

cloudflare.com

Today, Cloudflare is announcing the development of Firewall for AI, a protection layer that can be...
Today, Cloudflare is announcing the development of Firewall for AI, a protection layer that can be deployed in front of Large Language Models (LLMs) to identify abuses before they reach the models. While AI models, and specifically LLMs, are surging, customers tell us that they are concerned about the best strategie...

ai developer platform llm security security week
1
Why do we need for an Undefined Behavior Annex to C++

intel.com

Intel's developer software engineers are not only working on the latest optimizations and improvements in the...
Intel's developer software engineers are not only working on the latest optimizations and improvements in the Intel® oneAPI DPC++/C++ Compiler. We actively contribute to the advancements of Khronos Group's SYCL*, the LLVM* Project, and the latest C and C++ language standards .We would like to share a more detailed p...

c++functional safety oneapi security standard
1
White House urges devs to switch to memory-safe programming languages

bleepingcomputer.com

The White House Office of the National Cyber Director (ONCD) urged tech companies today to switch...
The White House Office of the National Cyber Director (ONCD) urged tech companies today to switch to memory-safe programming languages, such as Rust, to improve software security by reducing the number of memory safety vulnerabilities. Such vulnerabilities are coding errors or weaknesses within software that can lea...

cybersecurity security software usa vulnerability
1