Search
Items tagged with: Security
If you use brew’s curl on macOS, are you really using it? I installed and had curl setup a couple of years ago. Today it appears that curl was now pointing to Apple’s version, which has this issue (https://daniel.haxx.se/blog/2024/03/08/the-apple-curl-security-incident-12604/). Looks like brew doesn’t add a symlink for curl to /opt/homebrew/bin. Running `ln -s /opt/homebrew/opt/curl/bin/curl /opt/homebrew/bin` resolved the issue.
T-Mobile Employees Across The Country Receive Cash Offers To Illegally Swap SIMs
I still stand by this: if #sms #mfa wasn’t still massively used (especially by the financial sector), sim swaps would be less attractive to sim swappers.
It’s also crazy so much trust is placed in telecoms guarding your phone number and MFA factor for your bank. 🫨
#security #cybersecurity #simswap
T-Mobile Employees Across The Country Receive Cash Offers To Illegally Swap SIMs
T-Mobile employees, both third-party and corporate, are receiving cash offers via text to complete SIM swaps for criminals.Jman100 (The Mobile Report)
#curl sometimes fails to access some servers. In most situations the problem is not in curl itself but on the server side. Example:
1. Fails: curl https://www.radissonhotels.com
2. Works: curl -A 'Mozilla/5.0 xx Chrome/119' https://www.radissonhotels.com
3. Fails: curl -A 'Mozilla/5.0 xx Chrome/118' https://www.radissonhotels.com
4. Fails, too: curl -A 'Mozilla/5.0 xx Chrome/1189' https://www.radissonhotels.com
Perhaps they perform #filtering to obtain improved #security? It's hard to tell, but any serious attacker surely knows how to spoof the user agent string and bypass such simple #regex
Security Bits by @bart — 14 April 2024 https://www.podfeet.com/blog/2024/04/sb-2024-04-14/
Security Bits — 14 April 2024 - Podfeet Podcasts
Feedback & Followups Listener and community feedback, developments in recently covered stories, and developments in long-running stories we’re tracking over time.Bart Busschots (Podfeet Podcasts)
Time for another release... Accrescent 0.19.0 is out! While not much has changed on the surface, Accrescent now uses our new server infrastructure which brings faster downloads to everyone!
Read the release notes or download below 👇
https://github.com/accrescent/accrescent/releases/tag/0.19.0
#accrescent #security #privacy #appstore #android
Release 0.19.0 · accrescent/accrescent
This release marks the migration of Accrescent's servers to a more scalable setup. From this version on, Accrescent will connect to the new servers. Earlier versions of Accrescent will automaticall...GitHub
Let's use @protonprivacy and @Tutanota products.
Encryption is the single best hope against surveillance.
https://www.wired.com/story/house-section-702-vote/
#security #cybersecurity #infosec #nationalsecurity #nsa #fbi #section702 #privacy #government #surveillance #e2ee #tech #proton #protonmail #tuta #tutanota #bigtech #degoogle
House Votes to Extend—and Expand—a Major US Spy Program
The US House of Representatives voted on Friday to extend the Section 702 spy program. It passed without an amendment that would have required the FBI to obtain a warrant to access Americans’ information.Dell Cameron (WIRED)
Hey! Let's talk about #SSH and #security!
If you've ever looked at SSH server logs you know what I'm about to say: Any SSH server connected to the public Internet is getting bombarded by constant attempts to log in. Not just a few of them. A *lot* of them. Sometimes even dozens per second. And this problem is not going away; it is, in fact, getting worse. And attackers' behavior is changing.
The graph attached to this post shows the number of attempted SSH logins per day to one of @cloudlab s clusters over a four-year period. It peaks at about 3.4 million login attempts per day.
This is part of a study we did on our production system, using logs of more than 640 million login attempts, covering more than 1,500 hosts on our side and observing more than 840 thousand incoming IP addresses.
A paper presenting our analysis and a new, highly effective means to block SSH brute force attacks ("Where The Wild Things Are: Brute-Force SSH Attacks In The Wild And How To Stop Them") will be presented next week at #NSDI24 by @sachindhke . The full paper is at https://www.flux.utah.edu/paper/singh-nsdi24
Let's dive in. 🧵
2 days ago I reported about a #security patch having been applied to the IzzyOnDroid F-Droid repo aka #IzzySoftRepo – but I didn't give much details. After it was tested now at the IoD test & staging area, and running smoothly for two days for the public one, I reported back to its author @obfusk that all seems smooth, and she decided to make POC & patch public. You can find the full details at https://github.com/obfusk/fdroid-fakesigner-poc & https://www.openwall.com/lists/oss-security/2024/04/08/8 now. @fdroidorg @eighthave be welcome using it!
1/2
GitHub - obfusk/fdroid-fakesigner-poc: F-Droid Fake Signer PoC
F-Droid Fake Signer PoC. Contribute to obfusk/fdroid-fakesigner-poc development by creating an account on GitHub.GitHub
FreeBSD Foundation and Digital Security by Design (DSbD)
❝… CHERI and CheriBSD, developed to revolutionize hardware-based protection against memory safety vulnerabilities, were developed by a collaboration from researchers from the University of Cambridge, alongside corporate partners such as Google, Microsoft, Arm, and SRI International, and with support from the UK government. …❞
FreeBSD Foundation and Digital Security by Design (DSbD) Announce Beacon Award Winners for Innovations and Improvements to CheriBSD
Winning Projects Highlight CheriBSD's Role in Advancing Digital Security...FreeBSD Foundation
I am getting tired of reading about the #xz #security issue as if it is all about issues within #opensource. It is much bigger than that, and those takes conflate the problem with the solution.
So I wrote "The xz issue isn't about Open Source" here: https://changelog.complete.org/archives/10642-the-xz-issue-isnt-about-open-source
The xz Issue Isn’t About Open Source
You’ve probably heard of the recent backdoor in xz. There have been a lot of takes on this, most of them boiling down to some version of: The problem here is with Open Source Software. I want…The Changelog
https://www.theregister.com/2024/03/28/ai_bots_hallucinate_software_packages/
#security #AI #MachineLearning
AI hallucinates software packages and devs download them – even if potentially poisoned with malware
Simply look out for libraries imagined by ML and make them real, with actual malicious code. No wait, don't do thatThomas Claburn (The Register)
https://boehs.org/node/everything-i-know-about-the-xz-backdoor
I have begun a post explaining this situation in a more detailed writeup. This is updating in realtime, and there is a lot still missing.
Everything I know about the XZ backdoor
Please note: This is being updated in real time. The intent is to make sense of lots of simultaneous discoveriesboehs.org
Unfolding now: https://news.ycombinator.com/item?id=39865810
- https://www.openwall.com/lists/oss-security/2024/03/29/4
- https://github.com/tukaani-project/xz/commit/cf44e4b7f5dfdbf8c78aef377c10f71e274f63c0
An incredibly technically complex #backdoor in xz (potentially also in libarchive and elsewhere) was just discovered. This backdoor has been quietly implemented over years, with the assistance of a wide array of subtly interconnected accounts:
- https://github.com/tukaani-project/xz/commit/ee44863ae88e377a5df10db007ba9bfadde3d314
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067708
- https://github.com/jamespfennell/xz/pull/2
The timeline on this is going to take so long to unravel
feat: update vendored xz to 5.6.1 by jaredallard · Pull Request #2 · jamespfennell/xz
Updates the vendored version of xz to be 5.6.1. Also updates the vendor script to support the addition of SPDX-License-Identifier headers into some files.GitHub
🚨 ⚠️ Emergency PSA: A critical security exploit was discovered in the xz package recently, used for compression and decompression on nearly all Linux distributions.
Rawhide users ARE impacted and should immediately STOP using Rawhide until the package update is fully rolled back. (1/3)
Security Advisory: https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
#Fedora #Linux #OpenSource #Security #Privacy
Urgent security alert for Fedora Linux 40 and Fedora Rawhide users
Red Hat Information Risk and Security and Red Hat Product Security learned that the latest versions of the “xz” tools and libraries contain malicious code that appears to be intended to allow unauthorized access., (Red Hat)
Upgrade your systems now!
The xz package has been backdoored
https://archlinux.org/news/the-xz-package-has-been-backdoored/
New bookmark: Firefox bug 1886557: Make JIT Spraying implausible.
This could be the biggest leap forward in years when it comes to SpiderMonkey catching up to V8 and JSC’s JIT hardening. So far, I’ve been telling security-conscious Firefox users to disable the JIT compiler, and to use Chromium when JIT is necessary; maybe I won’t have to in a few years’ time.
Originally posted on seirdy.one: See Original (POSSE). #browsers #firefox #security
🇩🇪 Ich habe ja schon erwähnt, dass im Januar für das #IzzySoftRepo zusätzliche APK-Checks implementiert wurden. Jetzt habe ich es endlich geschafft, auch den zugehörigen Blog-Artikel fertig zu stellen.
Vielleicht interessiert es Euch ja, einen Blick auf Details und Hintergründe zu werfen? Ihr finden den Artikel "Zusätzliche APK-Checks im IzzyOnDroid Repo" hier:
https://android.izzysoft.de/articles/named/iod-scan-apkchecks?lang=de
Zusätzliche APK-Checks im IzzyOnDroid Repo
Nachdem der Library-Scanner nun seit mehreren Jahren im IzzyOnDroid Repo im Einsatz ist war es an der Zeit, einige zusätzliche APK-Prüfungen zu etablieren.IzzyOnDroid
🇺🇸 I've told you about additional APK checks having been implemented at the #IzzySoftRepo in January. Now finally I found the time to complete the article explaining the details, so you might wish to take a look at "Ramping up security: additional APK checks are in place with the IzzyOnDroid repo":
https://android.izzysoft.de/articles/named/iod-scan-apkchecks?lang=en
Edit: Tags:
Ramping up security: additional APK checks are in place with the IzzyOnDroid repo
With the library scanner in place for multiple years, it was about time to establish some additional APK checks with the IzzyOnDroid F-Droid repository.IzzyOnDroid
- YouTube Videos (17%, 66 votes)
- Articles/Blog Posts (75%, 284 votes)
- Forum Discussions (7%, 28 votes)
https://www.nitrokey.com/products/nethsm
#HSM #OpenSource #OpenHardware #Security
At long last, a blog update... on updates? Check out this article on Accrescent's progress toward delta updates with conceptual explanations, benchmarks, and lots of pretty graphs!
https://lberrymage.dev/posts/ina-part-1/
#android #accrescent #security
Ina, Part 1: Smaller, faster, and safer software updates for Accrescent
Introduction Well! It’s been a long time since I’ve shared an Accrescent update here (most development discussion takes place in our Matrix rooms), but today I have a big one: we’ve made significant progress in developing delta updates! “That sounds …Logan Magee (Logan's Blog)
Accrescent 0.18.0 released! This is a minor one with removed privileged installer support and maintenance updates. Changelog below.
https://github.com/accrescent/accrescent/releases/tag/0.18.0
#accrescent #privacy #security #android #appstore
Release 0.18.0 · accrescent/accrescent
This release removes privileged installer support, as it is not currently necessary for any functionality. Removals Remove privileged installer support Updates Bump AGP to 8.3.1 Bump Coli to 2.6...GitHub
It's 2024 and #Google is now requiring bulk #email senders to use DMARC, SPF, & DKIM when emailing #Gmail users. 👍
👉 https://tuta.com/blog/google-introducing-new-security-requirements
This is a great step, BUT why did they allow bulk senders to send #spam emails without proper #security standards until now? 🤔
Google introduces new security requirements for bulk email senders - but should have done so years ago.
Google and Yahoo! will require the use of DMARC, SPF, and DKIM in an attempt to crackdown on spam and phishing. It is surprising that these features were not already a requirement.Tutanota
Privacy can be powerful. The Librem 14 is the first ultra-portable laptop for the security-conscious- designed chip-by-chip, line-by-line, to respect your rights to privacy, security, and freedom.
Order yours now! https://puri.sm/products/librem-14/… #security #privacy #laptops
Today we are proud to announce the launch of the world's first #postquantum secure email platform! 🥳🎉
With TutaCrypt your data is safe against quantum computer attacks at rest & in transit. ⚛️ 🔒
Learn more about this quantum leap in #security here: https://tuta.com/blog/post-quantum-cryptography
Post Quantum Cryptography: Why We Need Resistant Encryption NOW.
Quantum-resistant or post-quantum cryptography is our best bet against attacks from upcoming quantum computers to increase security and privacy.Tutanota
the #Apple #curl #security incident 12604 - or why CA cert verification is unreliable with curl on apple OS
https://daniel.haxx.se/blog/2024/03/08/the-apple-curl-security-incident-12604/
LLVM CFI and Cross-Language LLVM CFI Support for Rust, https://bughunters.google.com/blog/4805571163848704/llvm-cfi-and-cross-language-llvm-cfi-support-for-rust.
> add LLVM CFI and cross-language LLVM CFI (and LLVM KCFI and cross-language LLVM KCFI) to the Rust compiler as part of our work in the Rust Exploit Mitigations Project Group. This is the first cross-language, fine-grained, forward-edge control flow protection implementation for mixed-language binaries that we know of.
Really interesting project.
#RustLang #llvm #security #safety #ffi
Blog: LLVM CFI and Cross-Language LLVM CFI Support for Rust
We’re pleased to share that we’ve worked with the Rust community to add LLVM CFI and cross-language LLVM CFI (and LLVM KCFI and cross-language LLVM KCFI) to the Rust compiler as part of our work in the Rust Exploit Mitigations Project Group.bughunters.google.com
Sometimes finding perfect #search results can be a pain and Google buying dominance doesn't help. 🔎
👉 https://tuta.com/blog/google-search-monopoly
Not all search engines offer the same performance, #security, and #privacy! 🤔
Which search engine is your favorite? Let us know in the comments!
Google Pays 1150 Times More for Its Search Monopoly Than for Lobbying in the EU & US
Break the Google Search monopoly! Your data is worth billions, take back control!Tutanota
- DuckDuckGo (64%, 265 votes)
- Ecosia (7%, 30 votes)
- StartPage (21%, 90 votes)
- Qwant (6%, 27 votes)
Just a bit of a ramble on #android and #apple and #privacy and #security inspired by a recent post by @beardedtechguy.
It's a bit of a ranty post, but not trying to be mean 
This is day 19 of #100DaysToOffload
https://joelchrono.xyz/blog/apple-android-security-and-features/
Apple vs Android on Security and Features
This post by Kyle triggered me a little bit, so I wrote a response with my opinion on the matterjoelchrono.xyz
Protecting your #privacy starts with threat modeling.
By accurately accessing your online #security threats & potential weaknesses, you can better protect your #digital life.
You are one of kind & so is your threat model. You can learn more here: https://tuta.com/blog/threat-modeling-for-you
Threat Modeling In 2024: Your Guide For Better Security
Threat model best practices to evaluate your personal cybersecurity and privacy threat landscape.Tutanota
#Nevada aims to stop minors from using end-to-end #encryption to protect their data. 🚫
Stand up for encryption & #privacy! ✊
This isn't protecting the youth, it's #victimblaming at its finest.
We must stop NV Attorney General Aaron Ford from undermining basic #security practices!
👉 https://tuta.com/blog/nevada-blocks-encryption-for-minors
Nevada Courts Want To Prevent Teens From Using End-to-End Encryption
Stripping teens of their right to strong encryption will not leave them safer or better protected from harm.Tutanota
🚀 Exciting News! 🚀
We're consolidating our cryptographic libraries with Rust! 🦀
With a unified crypto library, we simplify development, speed up deployment, and ensure consistent security measures across all clients.
This milestone marks a significant step in our journey.
Join us in celebrating this achievement, and looking forward to even more exciting developments ahead! 🎉
https://element.io/blog/meet-element-r-our-new-unified-crypto-implementation/
#Element #Rust #Security #ElementX
Meet Element R: our new unified crypto implementation
We’ve created a common cryptographic library implementation in Rust - codenamed Element R - for all our Element clients.Archie W (Element Blog)
Threat Modeling In 2024: Your Guide For Better #Security
@Tutanota shares some tips on developing a threat model for your personal use case.
https://tuta.com/blog/threat-modeling-for-you
Threat Modeling In 2024: Your Guide For Better Security
Threat model best practices to evaluate your personal cybersecurity and privacy threat landscape.Tutanota
Performed by Trail of Bits. They found things to fix but nothing critical and no security flaws.
https://daniel.haxx.se/blog/2024/02/23/curl-http-3-security-audit/
#monocles chat 1.7.9 is released on the playstore with a lot of updates and improvements! (See comments below)
https://play.google.com/store/apps/details?id=eu.monocles.chat
#xmpp #chat #privacy #security #messenger
monocles chat - Apps on Google Play
monocles chat - The secure and ethical chat clientplay.google.com
RFC time! We're working on specifying how Accrescent's repository should look technically.
If you're an app developer who cares about app store features, an Accrescent user, or just interested in our development, leave your comments in the issue below 👇
https://github.com/accrescent/meta/issues/31
#android #appstore #security #privacy #accrescent
RFC: Repository metadata reorganization · Issue #31 · accrescent/meta
Problem Accrescent's repository metadata format and organization was not designed for cacheability, internationalization, or atomicity. As a result, Accrescent has limited scalability, target audie...GitHub
https://www.isc.org/blogs/2024-bind-security-release/
#dns #security
BIND 9 Security Release and Multi-Vendor Vulnerability Handling, CVE-2023-50387 and CVE-2023-50868
Yesterday we published BIND 9.16.48, 9.18.24, and 9.19.21. These releases mitigate several vulnerabilities that are described in our announcement.www.isc.org