Why Vaccine Cards Are So Easily Forged
March 18 2022My proof of COVID-19 vaccination is recorded on an easy-to-forge paper card. With little trouble, I could print a blank form, fill it out, and snap a photo....
Read moreSamsung Encryption Flaw
March 4 2022Researchers have found a major encryption flaw in 100 million Samsung Galaxy phones.
From the abstract:
In this work, we expose the cryptographic design and implementation of Android’s Hardware-Backed Keystore...
Read more
Vulnerability in Stalkerware Apps
March 2 2022TechCrunch is reporting — but not describing in detail — a vulnerability in a series of stalkerware apps that exposes personal information of the victims. The vulnerability isn’t in...
Read moreVendors are Fixing Security Flaws Faster
February 16 2022Google’s Project Zero is reporting that software vendors are patching their code faster.
tl;dr
- In 2021, vendors took an average of 52 days to fix security vulnerabilities reported from Project... Read more
Finding Vulnerabilities in Open Source Projects
February 2 2022The Open Source Security Foundation announced $10 million in funding from a pool of tech and financial companies, including $5 million from Microsoft and Google, to find...
Read moreTwelve-Year-Old Linux Vulnerability Discovered and Patched
January 31 2022It’s a privilege escalation vulnerability:
Linux users on Tuesday got a major dose of bad news — a 12-year-old vulnerability in a system tool called Polkit gives attackers unfettered...
Read more
More Log4j News
December 16 2021Log4j is being exploited by all sorts of attackers, all over the Internet:
At that point it was reported that there were over 100 attempts to exploit the vulnerability...
Read more
On the Log4j Vulnerability
December 14 2021It’s serious:
The range of impacts is so broad because of the nature of the vulnerability itself. Developers use logging frameworks to keep track of what happens in a...
Read more
Hiding Vulnerabilities in Source Code
November 1 2021Really interesting research demonstrating how to hide vulnerabilities in source code by manipulating how Unicode text is displayed. It’s really clever, and not the sort of attack one...
Read moreMissouri Governor Doesn’t Understand Responsible Disclosure
October 18 2021The Missouri governor wants to prosecute the reporter who discovered a security vulnerability in a state’s website, and then reported it to the state.
The newspaper agreed to hold...
Read more
Recent Comments