Collaborate Disseminate
If you’ve answered as many spam calls as I have, you probably hear the warranty scam robocall in your sleep: “We’ve been trying to reach you about your car’s extended …read more Continue reading This Week in Security: Your Car’s Extended Warranty, Seizing the Fediverse, and Arm MTE
Up first is Zenbleed, a particularly worrying speculative execution bug, that unfortunately happens to be really simple to exploit. It leaks data from function like strlen, memcpy, and strcmp. It’s …read more Continue reading This Week in Security: Zenbleed, Web Integrity, and More!
As the old saying goes, there’s no such thing as a lock that can’t be picked. However, it seems like there are plenty of examples of car manufacturers that refuse …read more Continue reading Car Security System Monitors Tiny Voltage Fluctuations
Up first this week is a report from vpnMentor, covering the unsecured database backing a set of dating apps, including 419 Dating. The report is a bit light on the …read more Continue reading This Week in Security: Dating App, WooCommerce, and OpenSSH
There are a huge number of products available in the modern world that come with network connectivity now, when perhaps they might be better off with out it. Kitchen appliances …read more Continue reading Remote Code Execution on an Oscilloscope
USB devices are now ubiquitous and, from an information security standpoint, this is a terrifying prospect as malicious software can potentially be injected into a system by plugging in a …read more Continue reading Sleuth Untrusted USB Communication with USBValve
Mobile PINs are a lot like passwords in that there are a number of very common ones, and [Mobile Hacker] has a clever proof of concept that uses a tiny …read more Continue reading Brute Forcing a Mobile’s PIN Over USB With a $3 Board
First up, Apple issued an emergency patch, then yanked, and re-issued it. The problem was a Remote Code Execution (RCE) vulnerability in WebKit — the basis of Apple’s cross-platform web …read more Continue reading This Week in Security: Apple’s 0-day, Microsoft’s Mess, and More
It appears we have something of a problem. It’s not really a new problem, and shouldn’t be too surprising, but it did pop up again this week: bogus CVEs. Starting …read more Continue reading This Week in Security: Bogus CVEs, Bogus PoCs, And Maybe a Bogus Breach
Malicious flash drives have come a long ways since the old days of autorun infections. It’s not an accident that Microsoft has tightened down the attack surface available of removable …read more Continue reading This Week in Security:Camaro Dragon, RowPress, and RepoJacking