On Software Liabilities
February 8 2024Over on Lawfare, Jim Dempsey published a really interesting proposal for software liability: “Standard for Software Liability: Focus on the Product for Liability, Focus on the Process for...
Read moreData Exfiltration Using Indirect Prompt Injection
December 22 2023Interesting attack on a LLM:
In Writer, users can enter a ChatGPT-like session to edit or create their documents. In this chat session, the LLM can retrieve information from...
Read more
New Windows/Linux Firmware Attack
December 12 2023Interesting attack based on malicious pre-OS logo images:
LogoFAIL is a constellation of two dozen newly discovered vulnerabilities that have lurked for years, if not decades, in Unified Extensible...
Read more
New Bluetooth Attack
December 8 2023New attack breaks forward secrecy in Bluetooth.
BLUFFS is a series of exploits targeting Bluetooth, aiming to break Bluetooth sessions’ forward and future...
Read more
Breaking Laptop Fingerprint Sensors
November 29 2023They’re not that good:
Security researchers Jesse D’Aguanno and Timo Teräs write that, with varying degrees of reverse-engineering and using some external hardware, they were able to fool the...
Read more
Email Security Flaw Found in the Wild
November 21 2023Google’s Threat Analysis Group announced a zero-day against the Zimbra Collaboration email server that has been used against governments around the world.
TAG has observed four different groups...
Read more
In a rare squid/security post, here’s an article about unpatched vulnerabilities in the Squid caching proxy. As usual, you can also use this squid post to talk about the security...
Read moreLeaving Authentication Credentials in Public Code
November 16 2023Interesting article about a surprisingly common vulnerability: programmers leaving authentication credentials and other secrets in publicly accessible software code:
Researchers from security firm GitGuardian this week reported finding...
Read more
New SSH Vulnerability
November 16 2023This is interesting:
For the first time, researchers have demonstrated that a large portion of cryptographic keys used to protect data in computer-to-server SSH traffic are vulnerable to complete...
Read more
Critical Vulnerability in libwebp Library
September 27 2023Both Apple and Google have recently reported critical vulnerabilities in their systems—iOS and Chrome, respectively—that are ultimately the result of the same vulnerability in the libwebp...
Read more
Recent Comments