Hasty Briefsbeta

All tags

#security

683 stories total

Bilingual

SSL Configuration Generator
6 months ago
- Mozilla SSL Configuration Generator provides SSL configurations for various server software.
- Server options include Apache, AWS ALB, Caddy, Nginx, and more.
- Three configuration levels: Modern (TLS 1.3), Intermediate (general-purpose), Old (backward compatible).
- Additional options include server version, OpenSSL version, and HTTPS redirection.
Fuzzing DNS Zone Parsers
6 months ago
- Frederic Cambus used AFL to fuzz DNS zone parsers, starting with statzone and then moving to other parsers like validns, BIND, NSD, and Knot.
- Fuzzing validns 0.8 quickly revealed NULL pointer dereferences in functions name2findable_name() and nsec_validate_pass2().
- NSD's nsd-checkzone was found to have two critical issues: an out-of-bounds read and a stack-based buffer overflow (CVE-2019-13207).
- The fuzzing process for NSD ran for over 16 days, resulting in 167 unique crashes, which were analyzed to identify valid issues.
- Both identified issues in NSD were fixed and slated for release in NSD 4.2.2.
- Fuzzing ldns with ldns-read-zone for 12 days only produced assertion-triggering crashes, not exploitable vulnerabilities.
- The author highlights the challenges of sorting through crashes to identify valid issues and the educational value of analyzing third-party code.
Magic Links
6 months ago
- Magic links were introduced around 2010 and gained popularity due to ease of use for both users and administrators.
- The process involves generating a unique token or code sent via email or SMS, which users click or enter to log in.
- Magic links address password management issues by eliminating the need for users to remember multiple passwords.
- They enhance security by reducing risks associated with password reuse, theft, and weak passwords.
- Magic links are simpler to implement compared to traditional password systems and require fewer resources.
- User experience is improved with a streamlined login process, potentially increasing engagement rates.
- Security is bolstered as magic links are temporary and tied to the user's email or phone number.
- Developers benefit from reduced code complexity and elimination of password storage vulnerabilities.
- Drawbacks include reliance on email/phone security and potential phishing risks.
- Implementation requires solid cybersecurity practices like HTTPS and secure token generation.
- Testing and optimization are crucial for ensuring functionality, user experience, and security.
- Continuous monitoring and updates are necessary to maintain an effective magic link system.
- Magic links represent a step towards a passwordless future, balancing security and usability.
Why are you (still) using OpenBSD?
6 months ago
- OpenBSD is a free UNIX-like OS forked from NetBSD in 1995, focusing on portability and security.
- Supports 10+ hardware architectures and includes widely-used software like OpenSSH, LibreSSL, and pf.
- OpenBSD is open-source, freely available, and compatible with virtualization platforms like Qemu, KVM, and VMware.
- Security features include privilege separation, stack protector, randomization, pledge(2), and unveil(2).
- Server applications: firewall (pf), router (bgpd), bastion (sshd), DHCP/DNS (dhcpd, nsd, unbound), mail (smtpd, spamd).
- Workstation tools: xenodm, Xorg, window managers (fvwm, cwm), terminal emulators (xterm, tmux), and editors (vi, mg).
- Offers ~12,000 binary packages for amd64/arm64, including Apache, Go, MariaDB, Chromium, Firefox, and LibreOffice.
- Simple installation, comprehensive man pages, and organized filesystem (/ for OS, /usr/local for third-party).
- Package management via pkg_info, pkg_add, pkg_delete; security patches via syspatch; upgrades via sysupgrade.
- Encourages RTFM (read documentation) and provides resources like mailing lists, blogs, and tutorials for learning.
Call Me Maybe: Eavesdropping encrypted LTE calls with ReVoLTE (2020)
6 months ago
- VoLTE (Voice over LTE) is a packet-based telephony service integrated into LTE, used by major telecom operators.
- VoLTE encrypts voice data with a stream cipher to prevent keystream reuse, but an implementation flaw allows the ReVoLTE attack.
- ReVoLTE exploits keystream reuse in subsequent calls within one radio connection, enabling eavesdropping on encrypted calls.
- The attack involves recording a target call and a subsequent keystream call to derive the keystream and decrypt the target call.
- Testing revealed 12 out of 15 base stations were vulnerable, mainly in Germany but also other countries.
- Mitigation involves patches provided by vendors, with German operators having applied them by the time of publication.
- An Android app (Mobile Sentinel) was developed to detect vulnerable base stations, requiring root access and a Qualcomm chipset.
- The attack's feasibility was demonstrated in a commercial network using commercial phones and tools like Airscope and ADB.
Mysterious drones spotted at airports across Europe. How worried should we be?
6 months ago
- Mysterious drones spotted at European airports raise concerns about potential Russian hybrid warfare tactics.
- Recent drone incursions in Poland and other NATO countries highlight vulnerabilities in airspace security.
- Discussion of a 'drone wall' defense system to protect Europe from cross-border drone threats.
- Drones in Ukraine are used for attacks, while in Western Europe, they are suspected for surveillance and disruption.
- Belgium, home to NATO and EU headquarters, is a significant target for mysterious drone activities.
- Counter-drone measures include detection systems, jamming, and destruction methods, but challenges remain in scalability and cost.
- The drone wall proposal faces financial and technological hurdles, with debates over funding and effectiveness.
- Experts suggest targeting drone launch sites as a more effective strategy than solely defensive measures.
- NATO's priority is air defense, but the drone wall's feasibility and timeline are under scrutiny.
- The rapid evolution of drone technology complicates defense efforts, creating a new arms race.
AI slop security engineering: Okta's NextJS-0auth troubles
6 months ago
- Reported two security issues to Okta’s auth0/nextjs-auth0 project in October.
- One bug was an oauth parameter injection allowing token scoping abuse and token leaks.
- Submitted a simple PR to fix the issue.
- PR was closed after 3 weeks, with the maintainer attributing the fix to someone else via an AI-generated commit.
- Maintainer admitted to using AI, which led to incorrect attribution and an AI-generated apology.
- Request to correct commit attribution was refused, raising copyright concerns.
- AI-generated details included a non-existent email, suggesting low-quality AI usage.
- First bug, allowing account hijacking, was fixed but not recognized as a security issue without a demonstration video.
- Maintainer Tushar Pandey did not correct the attribution mistake.
- Okta’s security team demanded a video proof for vulnerability recognition, deemed as an unreasonable requirement.
Researchers discover security vulnerability in WhatsApp
6 months ago
- IT-Security researchers from the University of Vienna and SBA Research identified a privacy weakness in WhatsApp's contact discovery mechanism.
- The flaw allowed the enumeration of 3.5 billion WhatsApp accounts by querying over 100 million phone numbers per hour.
- Exposed data included phone numbers, public keys, timestamps, and public profile information, revealing additional insights like operating system and account age.
- Millions of active WhatsApp accounts were found in countries where the platform is officially banned, such as China, Iran, and Myanmar.
- The study provided population-level insights, including global distribution of Android (81%) vs. iOS (19%) devices and regional privacy behavior differences.
- Nearly half of the phone numbers from the 2021 Facebook data leak were still active on WhatsApp, highlighting enduring risks.
- Meta (WhatsApp's parent company) has implemented countermeasures like rate-limiting and stricter profile visibility controls.
- The research was conducted ethically, with all collected data deleted before publication, and no message content was accessed.
- This study is part of a series examining security and privacy in instant messengers, building on previous research on delivery receipts and key management.
- The findings emphasize the need for continuous security evaluation and collaboration between researchers and industry to protect user privacy.
Verifying your Matrix devices is becoming mandatory
6 months ago
- Element will require device verification for encrypted messages starting April 2026.
- Unverified devices pose security risks and may be compromised.
- Device verification ensures messages are trusted and secure.
- Users must verify devices and set up recovery keys to continue encrypted messaging.
- Unverified devices will be unable to send or show message content in encrypted chats post-update.
- This update enhances overall security and trust in Element's messaging platform.
Go Cryptography State of the Union
5 months ago
- The 2025 Go Cryptography State of the Union covered updates in Go's cryptographic libraries, focusing on post-quantum key exchanges, FIPS 140 compliance, and security improvements.
- Post-quantum key exchanges were introduced in Go 1.24, using ML-KEM-768 alongside X25519 for hybrid security in TLS and SSH connections.
- FIPS 140-3 compliance was achieved with a native Go module, eliminating the need for BoringCrypto and cgo, while maintaining security standards.
- Security track record remains strong with no critical vulnerabilities ('ouches') since 2019 and a successful audit by Trail of Bits finding no issues.
- Improvements in cryptographic performance and API usability were highlighted, including faster AES-CTR, SHA-3 optimizations, and better RSA key generation.
- Testing methodologies were enhanced with mutation testing for assembly code and accumulated test vectors for comprehensive coverage.
- Future plans include TLS profiles for simplified configuration and potential passkey integration into the standard library.
- Geomys, the organization behind these efforts, expanded with new maintainers and continued support from clients like Smallstep, Ava Labs, and Tailscale.
Data-at-Rest Encryption in DuckDB
5 months ago
- DuckDB v1.4 introduces database encryption capabilities for data-at-rest using AES-GCM-256 and AES-CTR-256.
- Encryption in DuckDB includes main database headers, blocks, write-ahead logs (WAL), and temporary files.
- Key management involves deriving secure keys from user-provided keys and storing them securely in memory.
- Performance impact of encryption is minimal, especially when using OpenSSL with hardware acceleration.
- DuckDB supports encrypting existing databases, creating new encrypted databases, and re-encrypting databases.
- Encryption enhances security for deployment models like CDN distribution and cloud storage.
Moving Beyond the NPM Elliptic Package
5 months ago
- The elliptic JavaScript package has unfixed cryptographic vulnerabilities.
- The maintainer of elliptic is unresponsive to security issues.
- Over 3000 NPM packages depend on elliptic, posing a security risk.
- A shim package, elliptic-to-noble, is introduced to replace elliptic with noble-curves.
- The shim allows quick migration without breaking changes or pressuring the elliptic maintainer.
- Users are encouraged to migrate to noble-curves for better security.
New .env file support in 1Password environments
5 months ago
- 1Password introduces new .env file support in its environments feature, enhancing secure storage and collaboration for developers.
- The new feature allows developers to use and manage .env files securely within the 1Password desktop app, eliminating plaintext storage on disk.
- 1Password environments provide a dedicated workspace for project secrets, integrating with AWS Secrets Manager for production use.
- The solution addresses common .env file issues: plaintext storage, accidental Git commits, and cumbersome team collaboration.
- Developers can mount .env files virtually, ensuring secrets are not written to disk and remain secure, even when offline.
- Setup is quick and integrates with existing dotenv libraries, requiring no code changes.
- Future plans include expanding support to Windows and adding more destinations based on beta feedback.
GrapheneOS accuses compeitors of sabotage, exits France over police threats
5 months ago
- GrapheneOS is pulling its server infrastructure out of France due to negative press and perceived threats from French authorities.
- GrapheneOS has named Murena and iodé as competitors allegedly orchestrating a smear campaign against them.
- French media claimed GrapheneOS was used by criminals with a 'fake Snapchat' feature, which GrapheneOS denies, stating it's likely confusion with illegal forks.
- GrapheneOS is moving its servers to Canada, Germany, and the US, citing safety concerns and opposition to French surveillance policies.
- The team is considering contributing to Android Open Source Project (AOSP) to patch vulnerabilities used by law enforcement, potentially making all Android devices more secure.
- GrapheneOS accuses Murena and iodé of offering 'privacy theater' with inferior security standards and possible state cooperation.
Libpng 1.6.51: Four buffer overflow vulnerabilities fixed
5 months ago
- libpng 1.6.51 released to fix four buffer overflow vulnerabilities.
- Two high-severity (CVE-2025-64720, CVE-2025-65018) and two moderate-severity (CVE-2025-64505, CVE-2025-64506) vulnerabilities addressed.
- Vulnerabilities include heap buffer over-reads and out-of-bounds reads.
- All require processing a malicious PNG file, leading to information disclosure, denial of service, or arbitrary code execution.
- GitHub Security Advisories and specific commit fixes provided for each CVE.
- Users urged to upgrade to libpng 1.6.51 immediately.
Chinese drone impersonates British Typhoon fighter jet
5 months ago
- A Chinese military aircraft was tracked around Hainan, broadcasting the identity of a Royal Air Force Typhoon.
- The flight pattern and characteristics suggested it was a Chinese drone, not a Eurofighter.
- The incident highlights vulnerabilities in the ADS-B system, which lacks authentication.
- The use of an RAF hex code by a Chinese aircraft raises questions about intent—testing identity manipulation or misconfiguration.
- The UK government's approval of a Chinese mega embassy in London has raised security concerns.
- Criticism of UK political parties for perceived weakness in handling foreign threats, particularly from China and Russia.
- Discussions about the UK's readiness and commitment to defend against potential conflicts.
- Debate over support for Ukraine, with some advocating continued aid and others calling for negotiation.
Native Secure Enclave backed SSH keys on macOS
5 months ago
- MacOS Tahoe can generate and use secure-enclave backed SSH keys, replacing projects like Secretive.
- The shared library `/usr/lib/ssh-keychain.dylib` now supports loading keys directly from the secure enclave via `SecurityKeyProvider`.
- Create a Secure Enclave backed key requiring biometrics with `sc_auth create-ctk-identity -l ssh -k p-256-ne -t bio`.
- List created keys with `sc_auth list-ctk-identities` or `sc_auth list-ctk-identities -t ssh` for SSH fingerprints.
- Delete keys using `sc_auth delete-ctk-identity -h <Public Key Hash>`.
- Download public/private keypairs from the secure enclave with `ssh-keygen -w /usr/lib/ssh-keychain.dylib -K -N ""`.
- Use `ssh-copy-id -i id_ecdsa_sk_rk localhost` to copy the public key to authorized keys.
- Make keys available directly to `ssh-agent` with `ssh-add -K -S /usr/lib/ssh-keychain.dylib`.
- Configure `SecurityKeyProvider` in `.ssh/config` or set `export SSH_SK_PROVIDER=/usr/lib/ssh-keychain.dylib` in `.zprofile` for broader compatibility.
When Fake Security Is Mandated Real Security Becomes a Crime
5 months ago
- UEFI is described as a back door and de facto kill switch.
- Confidentiality and security are being privatized by corrupt entities who hold back-door keys to encryption.
- Mobile phones have inherent security vulnerabilities, some of which cannot be patched, such as those in the baseband OS.
- Developers of secure communication tools like Telegram and Signal are being targeted, blackmailed, or infiltrated.
- Secure communication is essential for protecting democracy and whistleblowers from abuses.
New Version of the MCP Specification
5 months ago
- Model Context Protocol (MCP) is an open protocol for integrating LLM applications with external data sources and tools.
- MCP standardizes connections between LLMs and contextual data, tools, and workflows using JSON-RPC 2.0 messages.
- Key components include Hosts (LLM applications), Clients (connectors), and Servers (services providing context and capabilities).
- MCP is inspired by the Language Server Protocol, aiming to standardize AI application integrations.
- Servers offer features like Resources, Prompts, and Tools; Clients offer Sampling, Roots, and Elicitation.
- Security principles emphasize User Consent and Control, Data Privacy, Tool Safety, and LLM Sampling Controls.
- Implementors should focus on robust consent flows, clear documentation, and security best practices.
Show HN: Safe-NPM – only install packages that are +90 days old
5 months ago
- safe-npm is a security-focused npm installer that protects projects from compromised packages by only installing versions that have been publicly available for a minimum of 90 days (default).
- It mitigates supply chain attacks by filtering out recently published versions, giving the security community time to detect malicious updates.
- Key features include:
- - Minimum age threshold for package versions (configurable via --min-age-days).
- - Ability to bypass age requirements for trusted packages (--ignore).
- - Strict mode to fail installations if dependencies don't meet age requirements (--strict).
- - Options to control dependency types (--dev, --prod-only).
- - Dry-run mode to preview installations (--dry-run).
- Installation methods:
- - Global installation via npm install -g @dendronhq/safe-npm.
- - Direct usage with safe-npm install.
- - Local development setup by cloning the repository and linking the binary.
- Use cases include:
- - Critical production systems where maximum security is needed (higher age thresholds).
- - CI/CD pipelines with strict dependency requirements.
- - Projects needing newer features with slightly more risk (lower age thresholds).
- Limitations:
- - Doesn't protect against packages malicious from inception.
- - Delays access to legitimate updates.
- - Requires trust in older versions' security.
- Security recommendations:
- - Combine with regular security audits (npm audit).
- - Review dependencies before adding.
- - Monitor security advisories.
- - Use lock files for reproducible builds.
- - Run in sandboxed environments.
- Requirements: Node.js 18+ and npm.

first prev21next

About|Login

#security

SSL Configuration Generator

Fuzzing DNS Zone Parsers

Magic Links

Why are you (still) using OpenBSD?

Call Me Maybe: Eavesdropping encrypted LTE calls with ReVoLTE (2020)

Mysterious drones spotted at airports across Europe. How worried should we be?

AI slop security engineering: Okta's NextJS-0auth troubles

Researchers discover security vulnerability in WhatsApp

Verifying your Matrix devices is becoming mandatory

Go Cryptography State of the Union

Data-at-Rest Encryption in DuckDB

Moving Beyond the NPM Elliptic Package

New .env file support in 1Password environments

GrapheneOS accuses compeitors of sabotage, exits France over police threats

Libpng 1.6.51: Four buffer overflow vulnerabilities fixed

Chinese drone impersonates British Typhoon fighter jet

Native Secure Enclave backed SSH keys on macOS

When Fake Security Is Mandated Real Security Becomes a Crime

New Version of the MCP Specification

Show HN: Safe-NPM – only install packages that are +90 days old