Collaborate Disseminate
There’s a fun logic flaw in how multiple online services handle OAuth logins, that abuses Microsoft’s Azure Active Directory service to allow account takeovers. The problem is how a site …read more Continue reading This Week in Security: nOAuth, MiniDLNA, and Ticket to Ride
Let’s Encrypt has made an enormous difference to the landscape of the web. The protocol used for authenticating and receiving certificates, ACME, has spawned quite a few clients of various …read more Continue reading This Week in Security: ACME.sh, Leaking LEDs, and Android Apps
[CuriousMarc] is back with more vintage HP hardware repair. This time it’s the HP 5245L, a digital nixie-display frequency counter from 1963. This unit is old enough to be entirely …read more Continue reading Do Not Attempt Disassembly: Analog Wizardry In A 1960s Counter
Modded Minecraft is having a security moment, to match what we’ve seen in the Python and JavaScript repositories over the last few months. It looks like things started when a …read more Continue reading This Week in Security: Minecraft Fractureiser, MOVEit, and Triangulation
Barracuda’s Email Security Gateway (ESG) has had a vulnerability in it for years. Tracked as CVE-2023-2868, this one was introduced back in version 5.1.3.001, and only got patched during the …read more Continue reading This Week in Security: Barracuda, Zyxel, and The Backdoor
Martin Hench really likes playing on the Red team — on the attack. He’s a financial geek, understands cryptocurrency, understands how money is moved around to keep it hidden, and …read more Continue reading Books You Should Read: Red Team Blues
The world may not be ready, but the .zip Top Level Domain (TLD) is here. It’s a part of the generic TLD category, which was expanded to allow applications for …read more Continue reading This Week in Security: .zip Domains, Zip scanning
Full disk encryption is the go-to solution for hardening a laptop against the worst-case scenario of physical access. One way that encryption can be managed is through a Trusted Platform …read more Continue reading This Week in Security: TPM and BootGuard, Drones, and Coverups
There’s a problem with Opera. No, not that kind of opera. The Oracle kind. Oracle OPERA is a Property Management Solution (PMS) that is in use in a bunch of …read more Continue reading This Week in Security: Oracle Opera, Passkeys, and AirTag RFC
Last week we briefly mentioned a vulnerability in the Papercut software, and more details and a proof of concept have been published. The vulnerability is one known as session puzzling. …read more Continue reading This Week in Security: Session Puzzling, Session Keys, and Speculation