Hasty Briefsbeta

All tags

#security

683 stories total

Bilingual

Hegseth had an unsecured internet line set up in his office to connect to Signal
a year ago
- Defense Secretary Pete Hegseth had an unsecured internet line in his office to use the Signal messaging app, bypassing Pentagon security protocols.
- The 'dirty' internet line lacks security filters, potentially exposing sensitive defense information to hacking or surveillance.
- Hegseth used Signal to share sensitive details about a military airstrike in chats, including one with President Trump's top national security officials.
- The Pentagon has secure communication networks (NIPRNet, SIPRNet, JWICS) for classified information, but Hegseth's setup included personal and classified computers.
- Signal, though encrypted, is not authorized for sensitive or classified information and can be hacked, raising security concerns.
- Hegseth's Signal use is under investigation by the Defense Department's acting inspector general following bipartisan Senate Armed Services Committee concerns.
- Trump and administration officials have expressed full support for Hegseth, dismissing leaks as 'fake news' and blaming disgruntled employees.
SAML's signature problem: It's not you, it's XML
a year ago
- SAML's signature validation is problematic due to XML Digital Signatures (XML DSIG) complexities.
- Common issues include reference confusion, canonicalization mismatch, signature wrapping attacks, and broken schema validation.
- Reference confusion occurs when multiple elements have the same ID or no ID, leading to incorrect element verification.
- Canonicalization mismatch happens when sender and receiver use different methods to normalize XML, causing verification failures.
- Signature wrapping attacks involve injecting a validly signed assertion alongside an unsigned one, tricking the application into using the wrong data.
- Broken or missing schema validation can allow malformed XML structures, potentially leading to vulnerabilities like XXE attacks.
- Best practices for secure SAML validation include strict reference validation, canonicalization awareness, schema validation, and using trusted libraries.
- SAML remains widely used in enterprise identity systems, despite its challenges and the rise of modern protocols like OIDC.
Commit signing in 2023 is kinda wack
a year ago
- The author discusses their skepticism towards traditional git commit signing methods due to complexity and impracticalities.
- They highlight issues with long-lived cryptographic identities, such as key compromise and loss, and the difficulty of maintaining them.
- The post explores current commit signing options like GPG, SSH, and S/MIME, noting their limitations in revocation and verification.
- Future solutions like Gitsign (part of Sigstore) and OpenPubkey are introduced, focusing on short-lived identities and transparency logs.
- Gitsign uses OpenID Connect for identity verification and embeds signing details in a transparency log, offering a different approach to commit signing.
- OpenPubkey is mentioned as a draft specification that reuses OpenID Connect identities for cryptographic purposes, though it has its own set of challenges.
- The author concludes by stating they don't currently sign commits but are open to adopting Gitsign once it gains wider adoption.
- They emphasize the importance of existing security measures like SSH key restrictions and branch protection rules.
Show HN: StackHound - Stop guessing repo's tech stack, analyze it in seconds
a year ago
- A Personal Access Token with repo scope (or public_repo for public repos) is required.
- Tokens must be managed securely.
- The StackHound API can be queried directly at the /api/analyze endpoint.
- The endpoint requires username and repo as query parameters.
- It analyzes dependency files (e.g., package.json, requirements.txt) to detect technologies.
- Include the token in the request header using Authorization: Bearer YOUR_TOKEN or X-GitHub-Token: YOUR_TOKEN.
- Code examples are provided for reference.
- Replace placeholders (YOUR_USERNAME, YOUR_REPO, YOUR_GITHUB_TOKEN) with actual values.
How a Single Line Of Code Could Brick Your iPhone
a year ago
- A vulnerability in iOS allows a single line of code to brick an iPhone by exploiting Darwin notifications.
- Darwin notifications are a low-level mechanism for message exchange between processes on Apple's operating systems, requiring no special privileges.
- The exploit involves sending a specific Darwin notification ('com.apple.MobileSync.BackupAgent.RestoreStarted') to trigger a 'Restore in Progress' mode, forcing a reboot.
- A proof-of-concept app, 'EvilNotify', demonstrated the exploit's capabilities, including locking the screen and simulating device restores.
- A more advanced version, 'VeryEvilNotify', used a widget extension to repeatedly trigger the exploit across reboots, effectively soft-bricking the device.
- Apple addressed the vulnerability in iOS 18.3 by requiring restricted entitlements to send sensitive Darwin notifications.
- The researcher received a $17,500 bug bounty for reporting the issue.
What the heck is AEAD again?
a year ago
- AEAD stands for 'Authenticated Encryption with Associated Data' and is the current industry standard for encryption.
- AEAD ensures both the confidentiality and authenticity of encrypted messages, preventing tampering and unauthorized access.
- Modern protocols like TLS 1.3 and QUIC require AEAD, and libraries like Google's Tink and libsodium support it.
- Authenticated Encryption (AE) ensures the message hasn't been altered and originates from someone with the secret key.
- Associated Data (AD) allows unencrypted data to be authenticated alongside encrypted data, ensuring its integrity.
- AEAD simplifies secure encryption by combining encryption and authentication into a single, misuse-resistant API.
- Popular AEAD ciphers include AES256-GCM and ChaCha20-Poly1305, with recommendations varying by use case and library.
Google Chrome 136 automatically upgrades your accounts to use passkeys
a year ago
- Chrome version 136.0.7103.49 introduces a new default setting in its Password Manager for passkey upgrades.
- The new feature allows websites to automatically create passkeys if the user has previously consented, without prominent modal mediation.
- This change is not highlighted in Chrome's 'What's New' page but is mentioned in the Chrome for developers blog.
- The update is aimed at web developers, not users, who do not have a choice in the matter.
- The feature is part of WebAuthn Conditional Create requests, facilitating 'passkey upgrades' for existing password credentials.
- The author expresses skepticism towards passkeys, preferring strong password generation/entry standards over the current password manager implementations.
Microsoft Telnet Server MS-TNAP Authentication Bypass
a year ago
- Critical 0-click remote authentication bypass vulnerability in Microsoft Telnet Server.
- Allows attackers to gain access as any user, including Administrator, without valid credentials.
- Exploits misconfiguration in NTLM Authentication processes of Telnet MS-TNAP extension.
- Affects Windows 2000 through Windows Server 2008 R2.
- No patch currently available; administrators advised to disable Telnet services immediately.
- Vulnerability stems from flawed SSPI configuration in Telnet Server.
- Exploit involves manipulating mutual authentication process to bypass server-side authentication.
- PoC exploit provided as standalone executable to limit impact.
- Target systems must have Telnet Server service running and network connectivity to target port.
- Recommendations include disabling Telnet, using SSH, and implementing network filtering.
Windows RDP lets you log-in using revoked passwords. Microsoft is ok with that
a year ago
- Microsoft's Remote Desktop Protocol (RDP) allows revoked passwords to still grant access to Windows machines.
- Password changes, typically a security measure, do not always revoke access via RDP.
- Independent researcher Daniel Wade reported this behavior, calling it a 'Trust Breakdown.'
- Microsoft states this is a design choice to prevent users from being locked out, not a security vulnerability.
- The issue affects millions of users in various settings, with no clear detection or resolution method available.
Fixing web browser history leaks
a year ago
- Web browsing history allows styling visited links differently, aiding navigation but posing privacy risks.
- CSS:visited pseudo-class enables styling differences, exploited via side-channel attacks to detect visited links.
- Various sophisticated side-channel techniques emerged, including DOM inspection, timing attacks, and pixel color attacks.
- Browsing habits can reveal sensitive information, enabling targeted profiling, cross-site tracking, and enhanced fingerprinting.
- Research shows browsing histories are unique and stable, with up to 97-99% uniquely identifying individuals.
- 2010 mitigations (lying about unvisited styles and restricting CSS) were complex and inadequate.
- A new solution proposes partitioning visited link history using a triple-key partition (Link URL, Top-Level Site, Frame Origin).
- This approach ensures isolation, conforms to privacy principles, and mitigates cross-site history leaks.
- Implemented in Chrome v132 (behind a flag), this solution aims to resolve privacy issues by 2025.
Malicious Go modules that completely wipe out your disk
a year ago
- Malicious Go modules identified by Socket can wipe a computer's hard drive.
- Go is a popular programming language known for concurrency and performance.
- The Go ecosystem lacks a central authority to vet modules, making it vulnerable to typosquatting.
- Three malicious Go modules were found using obfuscated code to hide harmful actions.
- The modules used array-based string obfuscation to reconstruct commands dynamically.
- The malicious code targeted Linux systems, executing commands to download and run harmful scripts.
- The scripts overwrote the hard drive with zeros, making data recovery impossible.
- Developers should verify dependencies, check source code, and use automated scanning tools to prevent such attacks.
Microsoft's new "passwordless by default" is great but comes at a cost
a year ago
- Microsoft is making passwordless logins the default for new accounts.
- Passkeys are being promoted as the new alternative to passwords, developed by major tech companies under the FIDO Alliance.
- Existing users will be prompted to enroll a passkey upon their next login.
- Passwords are costly and problematic, leading to weak security choices and breaches.
- Password spraying attacks have become more effective in breaching networks.
- Users must install Microsoft Authenticator to go fully passwordless, with other authenticator apps being incompatible.
- Without Microsoft Authenticator, users cannot remove their login passwords, undermining passkey security benefits.
Technical analysis of TM SGNL, the unofficial Signal app Trump officials use
a year ago
- Mike Waltz, former National Security Advisor, uses an unofficial Signal app called TM SGNL to communicate with Trump officials.
- TM SGNL archives messages automatically, including disappearing ones, potentially compromising security.
- The app is developed by TeleMessage, owned by Smarsh, with executives linked to Israeli intelligence.
- TM SGNL likely violates Signal's open-source license by not sharing its modified source code.
- The app is not publicly available; it's distributed via enterprise management services like Apple Business Manager or Google Enterprise.
- Trump officials likely use managed iPhones with TM SGNL installed via MDM, archiving messages to cloud or email servers.
- Documentation suggests archived messages are stored in Microsoft 365, SMTP, or SFTP destinations.
- TeleMessage also offers similar apps for WhatsApp, Telegram, and WeChat, likely violating their proprietary licenses.
- The iOS version of TM SGNL is distributed as an unlisted app in the App Store, requiring a direct link for installation.
Show HN: Pipask – safer pip without compromising convenience
a year ago
- Pipask is a secure drop-in replacement for pip that performs security checks before installing Python packages.
- It relies on PyPI metadata to avoid unnecessary code execution and asks for consent when execution is required.
- Pipask can be installed via pipx (recommended) or pip, and used just like pip with commands like `pipask install requests`.
- For convenience, users can alias pip to pipask in their shell configuration.
- Pipask performs multiple security checks including repository popularity, package age, known vulnerabilities, download statistics, and metadata verification.
- It uses PyPI's JSON API and collects security data from pypistats.org, GitHub/GitLab, OSV.dev, and PyPI's integrity API.
- A dry-run mode (`--dry-run`) allows checking security without installation.
- Only explicitly requested packages undergo full checks; transitive dependencies only get vulnerability checks.
- If approved, pipask delegates the actual installation to standard pip.
Source code for the unofficial Signal app used by Trump officials
a year ago
- Analysis of TM SGNL, an unofficial Signal app used by Trump officials, reveals its source code is publicly available.
- Source code for both Android and iOS versions of TM SGNL was found on TeleMessage's website, licensed under GPLv3.
- The Android source includes a full Git history, revealing contributors and their emails, while the iOS version lacks Git history.
- Hardcoded credentials and vulnerabilities were discovered in the source code.
- The app's use by high-ranking officials for discussing classified information and planning war crimes is highlighted as newsworthy.
- Mirrors of the source code have been published on GitHub for public access and analysis.
Single day Firebase bill for $100k
a year ago
- Firebase projects should not be left unattended to prevent security breaches.
- A hacker exploited an uncached object via Cloudflare, leading to over 100 million hits.
- Direct attacks on the origin bucket occurred after initial mitigation efforts.
- Cloudflare Workers can secure private bucket storage but incur costs per instance/minute.
- Default settings may lack rate limiting, posing a financial risk if misconfigured.
- The user decided to discontinue cloud services due to high financial risks.
Sanctum || A pq-safe and sandboxed VPN daemon
a year ago
- Sanctum is a privilege-separated VPN daemon for OpenBSD, Linux, and MacOS, ensuring security by isolating critical assets.
- It supports peer-to-peer tunnels that can traverse NAT, eliminating the need for firewall port configurations.
- Sanctum consists of multiple processes, each with a specific role, such as encryption (bless), decryption (confess), and key derivation (chapel).
- Processes are sandboxed and run under separate users, except for guardian and bishop, which have broader system access.
- The VPN uses a post-quantum safe key exchange, combining ECDH (x25519) and ML-KEM-1024, with traffic encrypted under AES256-GCM.
- Sanctum supports one-directional tunnels (pilgrim and shrine modes) and peer-to-peer connections via cathedrals, which act as relays without accessing session keys.
- Configuration involves setting up instance details, shared secrets, tunnel parameters, and process users.
- Sanctum can be built from source on supported platforms and requires libsodium for cryptographic operations.
When encryption works perfectly and still fails
a year ago
- Encryption is fundamental for secure communication but has inherent vulnerabilities beyond mathematical strength.
- Publicly discussed cryptography threats include breakthroughs in mathematical problems (e.g., P = NP, quantum computing), cryptanalysis (e.g., Enigma machine), and side-channel attacks (e.g., Spectre, Meltdown, Rowhammer).
- The most significant threat is human error, such as adding the wrong person to a group chat, bypassing encryption security.
- Example: National Security Advisor Mike Waltz accidentally added a journalist to a sensitive Signal group chat, exposing classified information.
- Key management is a critical and often overlooked challenge in cryptography, harder than the encryption itself (Kissner’s law).
- Key management issues include identity verification, key generation authority, and key revocation/rotation.
- Many breaches stem from key management failures (e.g., phishing) rather than cryptographic weaknesses.
- Key management lacks standardized solutions and heavily depends on application-specific user experience.
How are cyber criminals rolling in 2025?
a year ago
- Cyber criminals in 2025 exploit free hosting options like government and university websites due to their weak cyber security.
- Popular targets include OnlyFans accounts, Robux, Amazon gift cards, and free movies.
- Enterprise security tools often fail to flag malicious links as unsafe, including those analyzed by major security providers.
- Cyber criminals use trusted domains like Google services to bypass security measures.
- Exploitation methods include outdated plugins, cache poisoning, credential stuffing, and subdomain takeovers.
- The goal is often affiliate marketing or phishing, especially targeting children seeking free Robux.
- This method of exploitation is not new, with similar tactics reported as early as 2020.
Show HN: API Testing and Security with AI
a year ago
- 80% faster reduction in test creation and maintenance time.
- 78k APIs secured, proactively protected against security vulnerabilities.
- 60% fewer API threats, immediate reduction in security breaches.
- Qodex.ai automates API testing, reducing manual effort and increasing efficiency.
- Real-time Slack alerts for test failures and response time drops.
- Achieved 100% API test coverage without extensive QA teams.
- Seamless integration with CI/CD pipelines and tools like Postman and Jira.
- AI-driven test case generation in plain English, easy for non-technical users.
- Detailed reporting and analysis to detect anomalies in user flows.
- Positive customer feedback highlighting ease of use and effectiveness.

first prev3next

About|Login

#security

Hegseth had an unsecured internet line set up in his office to connect to Signal

SAML's signature problem: It's not you, it's XML

Commit signing in 2023 is kinda wack

Show HN: StackHound - Stop guessing repo's tech stack, analyze it in seconds

How a Single Line Of Code Could Brick Your iPhone

What the heck is AEAD again?

Google Chrome 136 automatically upgrades your accounts to use passkeys

Microsoft Telnet Server MS-TNAP Authentication Bypass

Windows RDP lets you log-in using revoked passwords. Microsoft is ok with that

Fixing web browser history leaks

Malicious Go modules that completely wipe out your disk

Microsoft's new "passwordless by default" is great but comes at a cost

Technical analysis of TM SGNL, the unofficial Signal app Trump officials use

Show HN: Pipask – safer pip without compromising convenience

Source code for the unofficial Signal app used by Trump officials

Single day Firebase bill for $100k

Sanctum || A pq-safe and sandboxed VPN daemon

When encryption works perfectly and still fails

How are cyber criminals rolling in 2025?

Show HN: API Testing and Security with AI