Collaborate Disseminate
The big news this week is Log4j, breaking just a few hours too late to be included in last week’s column. Folks are already asking if this is the most …read more Continue reading This Week in Security: Log4j, PDF CPU, and I Hacked Starlink
On December 5th, someone by the IRC nickname of [ubuntu] joined the Pine64 Discord’s #pinephone channel through an IRC bridge. In the spirit of December gift-giving traditions, they have presented …read more Continue reading PinePhone Malware Surprises Users, Raises Questions
Researchers at f-secure have developed an impressive new attack, leveraging HP printers as an unexpected attack surface. Printing Shellz (PDF) is a one-click attack, where simply visiting a malicious webpage …read more Continue reading This Week in Security: Printing Shellz, ms-officecmd, And AI Security
After the Thanksgiving break, we have two weeks of news to cover, so hang on for an extra-long entry. First up is GoDaddy, who suffered a breach starting on September …read more Continue reading This Week in Security: GoDaddy, Tardigrade, Monox, and BigSig
After an electronic IoT device has been deployed into the world, it may be necessary to reprogram or update it. But if physical access to the device (or devices) is …read more Continue reading How To Easily Set Up Secure OTA Firmware Updates on ESP32
Intel has announced CVE-2021-0146, a vulnerability in certain processors based on the Atom architecture, and the Trusted Platform Module (TPM) is at the center of the problem. The goal of …read more Continue reading This Week in Security: Intel Atoms Spill Secrets, ICMP Poisons DNS, and The Blacksmith
Maybe we really were better off with ASCII. Back in my day, we had space for 256 characters, didn’t even use 128 of them, and we took what we got. …read more Continue reading This Week in Security: Unicode Strikes, NPM Again, and First Steps to PS5 Crack
In a brilliant write-up, [Stephen Tong] brings us his “Use-After-Free for Dummies“. It’s a surprising tale of a vulnerability that really shouldn’t exist, and a walkthrough of how to complete …read more Continue reading This Week in Security:Use-After-Free For Dummies, WiFi cracking, and PHP-FPM
Good news, everyone! Security researcher [Mordechai Guri] has given us yet another reason to look askance at our computers and wonder who might be sniffing in our private doings. This …read more Continue reading Ethernet Cable Turned into Antenna to Exploit Air-Gapped Computers
The government of Argentina has a national ID card system, and as a result maintains a database containing data on every citizen in the country. What could possibly go wrong? …read more Continue reading This Week in Security: Argentina, MysterySnail, and L0phtcrack