Collaborate Disseminate
Ah, Google. Very few companies have mastered the art of creating amazing technology and products, and then so effectively abandoning and mishandling them. Case in point, YouTube. Citing “dislike attacks”, …read more Continue reading Getting Back that YouTube Dislike Button
In the past two weeks, Log4j has continued to drive security news, with more vulnerable platforms being found, and additional CVEs coming out. First up is work done by TrendMicro, …read more Continue reading This Week in Security: The Log4j That Won’t Go Away, WebOS, and More
The big news this week is Log4j, breaking just a few hours too late to be included in last week’s column. Folks are already asking if this is the most …read more Continue reading This Week in Security: Log4j, PDF CPU, and I Hacked Starlink
Researchers at f-secure have developed an impressive new attack, leveraging HP printers as an unexpected attack surface. Printing Shellz (PDF) is a one-click attack, where simply visiting a malicious webpage …read more Continue reading This Week in Security: Printing Shellz, ms-officecmd, And AI Security
After the Thanksgiving break, we have two weeks of news to cover, so hang on for an extra-long entry. First up is GoDaddy, who suffered a breach starting on September …read more Continue reading This Week in Security: GoDaddy, Tardigrade, Monox, and BigSig
Intel has announced CVE-2021-0146, a vulnerability in certain processors based on the Atom architecture, and the Trusted Platform Module (TPM) is at the center of the problem. The goal of …read more Continue reading This Week in Security: Intel Atoms Spill Secrets, ICMP Poisons DNS, and The Blacksmith
Maybe we really were better off with ASCII. Back in my day, we had space for 256 characters, didn’t even use 128 of them, and we took what we got. …read more Continue reading This Week in Security: Unicode Strikes, NPM Again, and First Steps to PS5 Crack
In a brilliant write-up, [Stephen Tong] brings us his “Use-After-Free for Dummies“. It’s a surprising tale of a vulnerability that really shouldn’t exist, and a walkthrough of how to complete …read more Continue reading This Week in Security:Use-After-Free For Dummies, WiFi cracking, and PHP-FPM
The government of Argentina has a national ID card system, and as a result maintains a database containing data on every citizen in the country. What could possibly go wrong? …read more Continue reading This Week in Security: Argentina, MysterySnail, and L0phtcrack
Apache 2.4.50 included a fix for CVE-2021-41773. It has since been discovered that this fix was incomplete, and this version is vulnerable to a permutation of the same vulnerability. 2.4.51 …read more Continue reading This Week in Security: The Apache Fix Miss, Github (Malicious) Actions, and Shooting the Messenger