Google Pays $10M in Bug Bounties in 2023
March 22 2024BleepingComputer has the details. It’s $2M less than in 2022, but it’s still a lot.
The highest reward for a vulnerability report in 2023 was $113,337, while the total...
Read more
On the Insecurity of Software Bloat
February 15 2024Good essay on software bloat and the insecurities it causes.
The world ships too much code, most of it by third parties, sometimes unintended, most of it uninspected. Because...
Read more
On Software Liabilities
February 8 2024Over on Lawfare, Jim Dempsey published a really interesting proposal for software liability: “Standard for Software Liability: Focus on the Product for Liability, Focus on the Process for...
Read moreData Exfiltration Using Indirect Prompt Injection
December 22 2023Interesting attack on a LLM:
In Writer, users can enter a ChatGPT-like session to edit or create their documents. In this chat session, the LLM can retrieve information from...
Read more
New Windows/Linux Firmware Attack
December 12 2023Interesting attack based on malicious pre-OS logo images:
LogoFAIL is a constellation of two dozen newly discovered vulnerabilities that have lurked for years, if not decades, in Unified Extensible...
Read more
New Bluetooth Attack
December 8 2023New attack breaks forward secrecy in Bluetooth.
BLUFFS is a series of exploits targeting Bluetooth, aiming to break Bluetooth sessions’ forward and future...
Read more
Breaking Laptop Fingerprint Sensors
November 29 2023They’re not that good:
Security researchers Jesse D’Aguanno and Timo Teräs write that, with varying degrees of reverse-engineering and using some external hardware, they were able to fool the...
Read more
Email Security Flaw Found in the Wild
November 21 2023Google’s Threat Analysis Group announced a zero-day against the Zimbra Collaboration email server that has been used against governments around the world.
TAG has observed four different groups...
Read more
In a rare squid/security post, here’s an article about unpatched vulnerabilities in the Squid caching proxy. As usual, you can also use this squid post to talk about the security...
Read moreLeaving Authentication Credentials in Public Code
November 16 2023Interesting article about a surprisingly common vulnerability: programmers leaving authentication credentials and other secrets in publicly accessible software code:
Researchers from security firm GitGuardian this week reported finding...
Read more
Recent Comments