Collaborate Disseminate
First up, Apple issued an emergency patch, then yanked, and re-issued it. The problem was a Remote Code Execution (RCE) vulnerability in WebKit — the basis of Apple’s cross-platform web …read more Continue reading This Week in Security: Apple’s 0-day, Microsoft’s Mess, and More
It appears we have something of a problem. It’s not really a new problem, and shouldn’t be too surprising, but it did pop up again this week: bogus CVEs. Starting …read more Continue reading This Week in Security: Bogus CVEs, Bogus PoCs, And Maybe a Bogus Breach
Malicious flash drives have come a long ways since the old days of autorun infections. It’s not an accident that Microsoft has tightened down the attack surface available of removable …read more Continue reading This Week in Security:Camaro Dragon, RowPress, and RepoJacking
These days Bluetooth-based gadgets are everywhere, including for car and solar batteries. After connecting them up to the battery, you download the accompanying app on your smartphone, open it up …read more Continue reading Bluetooth Battery Monitors That Also Monitor Your Position, Without Asking
There’s a fun logic flaw in how multiple online services handle OAuth logins, that abuses Microsoft’s Azure Active Directory service to allow account takeovers. The problem is how a site …read more Continue reading This Week in Security: nOAuth, MiniDLNA, and Ticket to Ride
Here at Hackaday we cover news and interesting features for the hacker community, with an emphasis more on the hardware side. Nevertheless we also cover stories from time to time …read more Continue reading The Simplest Social Engineering Hack Of Them All
For almost a year now, we’ve been following the progress [Walker] has been making with Ovrdrive — a completely open source USB flash drive that features the ability to destroy …read more Continue reading Updated OSHW Flash Drive Keeps Data Safe, Fingers Dry
Modded Minecraft is having a security moment, to match what we’ve seen in the Python and JavaScript repositories over the last few months. It looks like things started when a …read more Continue reading This Week in Security: Minecraft Fractureiser, MOVEit, and Triangulation
Barracuda’s Email Security Gateway (ESG) has had a vulnerability in it for years. Tracked as CVE-2023-2868, this one was introduced back in version 5.1.3.001, and only got patched during the …read more Continue reading This Week in Security: Barracuda, Zyxel, and The Backdoor
TLS, byte by byte performs an unusual and interesting function: it fetches itself over HTTPS, and provides a complete annotation of what’s going on in the process, one byte at …read more Continue reading Watch a Web Page Fetch Itself Over TLS, Complete With Commentary