Hasty Briefsbeta

All tags

#security

683 stories total

Bilingual

Memory-safe sudo to become the default in Ubuntu
a year ago
- Ubuntu 25.10 will adopt sudo-rs, a memory-safe reimplementation of sudo written in Rust.
- This change is part of Canonical's effort to improve system resilience by using memory-safe languages like Rust.
- Sudo-rs is developed by the Trifecta Tech Foundation (TTF) as part of their Privilege Boundary initiative.
- Canonical is sponsoring the completion of Milestone 5 for sudo-rs, including features like shell escape prevention and support for older Linux kernels.
- The transition aims to maintain compatibility with existing workflows while omitting niche features from the original sudo.
- Sudo-rs will be default in Ubuntu 25.10, with plans for inclusion in Ubuntu 26.04 LTS after community testing.
- The Trifecta Tech Foundation focuses on open-source infrastructure projects impacting digital security.
- Canonical provides open-source software and services across various systems and industries.
Curl: We still have not seen a single valid security report done with AI help
a year ago
- Daniel Stenberg, the curl CEO, is implementing strict measures against AI-generated security reports on HackerOne for curl.
- Reporters must now declare if they used AI to find or generate their submission, with follow-up questions if they did.
- Instant bans will be issued for reporters submitting what is deemed 'AI slop', as these reports are overwhelming the system.
- The idea of requiring a small deposit from researchers, refundable only if the report is valid, is being considered to reduce noise.
- There's a discussion on whether public bug bounty programs are still viable in the age of AI-generated attacks.
- Suggestions include HackerOne implementing identity verification and a point system to penalize repeat offenders of low-quality submissions.
- The issue reflects broader concerns about the sustainability of handling AI-generated content and attacks in tech security.
iVentoy tool injects malicious certificate and driver during Win install
a year ago
- iVentoy distributes unsafe Windows Kernel drivers through its installation files.
- The tool decrypts 'iventoy.dat' in RAM, revealing potentially malicious content.
- A provided Python script decrypts 'iventoy.dat' manually for analysis.
- Decrypted files contain viruses/trojans, as flagged by VirusTotal and Windows Defender.
- iVentoy installs a self-signed 'EV' certificate ('JemmyLoveJenny EV Root CA0') as trusted.
- The tool attempts to load kernel drivers signed by the bogus certificate.
- The security loophole allows bypassing Microsoft's driver integrity checks.
- GitHub hosts projects supporting fake certificate creation, raising security concerns.
Email and password authentication should be a last resort (rant)
a year ago
- Email + password authentication is considered the worst method due to multiple issues like password reuse, complex rules, and frequent password resets.
- Social logins offer convenience and security but depend on third parties and raise privacy concerns.
- License keys provide a simple UX but are prone to sharing and phishing.
- Magic links or email codes eliminate passwords but have delivery delays and awkward UX.
- Webauthn is the best current option, offering security and good UX with passwordless logins, though it's complex to implement and device-dependent.
Removal of Deepin Desktop from OpenSUSE Due to Packaging Policy Violation
a year ago
- Deepin Desktop removed from openSUSE due to packaging policy violations.
- Deepin packager bypassed security reviews via a 'License Agreement' dialog.
- Long history of security issues in Deepin components, including D-Bus and Polkit vulnerabilities.
- Communication and security culture with Deepin upstream found lacking.
- Users can still install Deepin from openSUSE devel repositories, but it's not recommended due to security concerns.
Open source project curl is sick of users submitting "AI slop" vulnerabilities
a year ago
- Daniel Stenberg, the lead of the curl project, expressed frustration over AI-generated bug reports flooding their channels.
- Curl, a 25-year-old open-source tool, uses HackerOne for vulnerability reports, but AI-generated submissions have become problematic.
- Stenberg announced that suspected AI-generated reports will require verification, and if confirmed, reporters will be banned.
- A recent AI-generated report claimed a novel HTTP/3 exploit in curl, but the submission contained errors and irrelevant details.
- The submitter failed to provide a valid patch, cited non-existent functions, and gave irrelevant hardening advice.
Why Intel Deprecated SGX?
a year ago
- Intel SGX is being deprecated in new processors, except for high-end Xeon CPUs for servers.
- SGX was introduced in 2015 with the 6th generation Skylake processors to address trust issues in cloud environments.
- SGX's complexity involves hardware (MEE), microcode, and firmware (Intel CSME infrastructure).
- SGX uses Intel EPID for attestation, which is complex and involves multiple CSME code modules.
- The attestation process involves secrets stored in e-fuses and keys generated by Intel's Key Generation Facility.
- SGX's implementation relies on a complex KDF process and keys stored in encrypted eFUSE.
- SGX's threat model initially included cloud service vendors and system administrators but missed kernel privilege attacks.
- Issues with SGX include over-design, lack of transparency, and potential use to protect malware.
- SGX's Linux kernel integration was delayed due to unresolved issues and was merged in Linux kernel v5.11 in Feb 2021.
- Despite its issues, SGX remains an effective security mechanism for server markets.
The Linux Kernel's PGP Web of Trust
a year ago
- The Linux kernel development process uses PGP, with subsystem maintainers using signed tags in pull requests to Linus Torvalds.
- Konstantin Ryabitsev maintains a git repository of relevant PGP keys, currently tracking 602 valid keys with trust paths from Linus Torvalds' key.
- GnuPG 2.4.x rejects third-party key signatures using SHA-1, potentially affecting the kernel's web of trust.
- If SHA-1 signatures were dropped, 485 public keys would lose trust paths, including keys of prominent developers like Andrew Morton and Greg Kroah-Hartman.
- A keysigning session at Embedded Recipes 2025 aims to improve the situation, with participation open by sending public keys to a specified email before the deadline.
CVE-2025-46336 (rack-session): Rack session gets restored after deletion
a year ago
- Rack::Session::Pool middleware vulnerability allows session restoration after deletion.
- Unauthenticated users can occupy a session if they trigger a long-running request adjacent to logout.
- Affects versions < 2.0.0; patched in >= 2.1.1.
- Mitigation includes updating rack-session, invalidating sessions atomically, or implementing a custom session store.
- Related to a similar issue in Rack < 3 (GHSA-vpfw-47h7-xj4g).
Fighting Unwanted Notifications with Machine Learning in Chrome
a year ago
- Chrome is launching warnings for unwanted notifications on Android to combat spammy or deceptive notifications.
- The feature uses on-device machine learning to detect potentially harmful notifications without compromising user privacy.
- Users will see the site name, a warning message, and options to unsubscribe or view the flagged content.
- Notifications are analyzed locally; contents are not sent to Google, ensuring privacy.
- The machine learning model was trained using synthetic data from Gemini LLM and evaluated by human experts.
- Initially available only on Android, with potential expansion to other platforms in the future.
- Safety Check in Chrome allows users to review notification permission revocations.
- Chrome Security and Google Safe Browsing continuously monitor and evolve defenses against web threats.
Using Git-upload-pack for a simpler CI integration
a year ago
- Screenshotbot does not require read-access to GitHub repositories, enhancing security and ease of integration with various Git providers.
- The platform uses a 'commit-graph' to track commit SHAs and their parents, without storing additional repository data.
- Challenges include difficulty supporting shallow clones and inefficiency with large monorepos.
- A new feature utilizes the git-upload-pack protocol to efficiently fetch commit information via SSH, bypassing the need for GitHub-specific APIs.
- The git-upload-pack protocol involves server-client negotiation for refs and commits, using packfiles for data transfer.
- Implementation of git-upload-pack in Screenshotbot allows for shallow clones and reduces network traffic by avoiding unnecessary blob transfers.
- Caveats include the protocol's complexity, variations in Git server behaviors, and specific requirements like multi_ack mode for Azure DevOps.
- The update enables Screenshotbot users to utilize shallow clones, improving build times.
Why not object capability languages?
a year ago
- Supply chain attacks are increasing due to deep dependency chains in software.
- Object capability languages propose sandboxing with opaque objects (capabilities) to limit actions.
- Capabilities are already used in handles, file descriptors, and JWT tokens but not within individual programs.
- Challenges include defining threat models, preventing memory tampering, and reusing existing code.
- Java's Joe-E subset demonstrates the radical changes needed for pure capability programming.
- The 'God Object' problem arises as main() must encapsulate all ambient authorities.
- Java's SecurityManager offered a non-pure capability system but was deprecated due to complexity and lack of use.
- Spectre attacks complicate in-process sandboxing by allowing unauthorized memory access.
- Chrome's Mojo system exemplifies a real-world object capability system with inter-process communication.
- Hardware isolation and memory protection keys (MPKs) can reduce overhead but require careful implementation.
In defense of self-signed certificates (2013)
a year ago
- Self-signed certificates trigger browser warnings despite being more secure than no certificate.
- Self-signed certificates prevent MITM attacks as effectively as CA-signed certificates when combined with certificate pinning.
- CA-signed certificates rely on trust in certificate authorities, which can be compromised, affecting all websites.
- Pinning self-signed certificates limits MITM opportunities to the first connection, unlike CA-signed certificates which have broader vulnerabilities.
- Real-world examples like Opera and Nokia show CA vulnerabilities leading to MITM attacks.
Stop Saying "Responsible Disclosure"
a year ago
- The term 'responsible disclosure' is vague and non-specific, as what is 'responsible' can vary widely depending on the situation.
- 'Coordinated Disclosure' is a more neutral term but still lacks specificity, prompting questions like 'in coordination with whom?'
- More precise alternatives include 'vendor-coordinated disclosure', 'maintainer-coordinated disclosure', or 'user-coordinated disclosure', which clarify who is involved in the process.
- User-coordinated disclosure is not a new concept but may be newly named, as seen in examples where researchers warn users about vulnerabilities.
- Specificity can be increased further, such as by including deadlines (e.g., 'vendor-coordinated disclosure with 90-day deadline').
- Disclosure policies are nuanced, and vague terms like 'responsible disclosure' should be challenged for greater clarity.
Show HN: CLI that spots fake GitHub stars, risky dependencies and licence traps
a year ago
- StarGuard is a CLI tool designed to detect risks in open-source projects, including fake stars, dependency hijacks, and license issues.
- It automates open-source due diligence for CTOs, security teams, and VCs, providing a fast and repeatable trust score.
- Key checks include star burst detection, dependency analysis, license scanning, maintainer activity, and code pattern scans.
- Output formats include JSON, Markdown, plaintext reports, and visual star-history plots.
- StarGuard uses GitHub API for data collection and includes modules like BurstDetector and User Profiler for analysis.
- It requires Python ≥ 3.9 and a GitHub Personal Access Token for high-rate API limits.
- Usage examples include full scans with star plots or burst-only fast scans.
- Target users include CTOs, security teams, VCs, and open-source maintainers.
- The tool is open-source, licensed under Apache-2.0, and focuses on static analysis without executing code.
I hacked a dating app (and how not to treat a security researcher)
a year ago
- Cerca Dating App had severe security vulnerabilities exposing private messages, passport information, and sexual preferences.
- The vulnerabilities included broken OTP authentication and open API endpoints, allowing unauthorized access to user data.
- A security researcher responsibly disclosed the issues to Cerca, but the company failed to respond or notify users despite patching the vulnerabilities.
- Exploits enabled access to over 6,000 user profiles, including sensitive ID documents and personal details.
- The lack of security measures could lead to identity theft, stalking, and blackmail, highlighting the need for better app security practices.
Can You Really Trust That Permission Pop-Up on macOS? (CVE-2025-31250)
a year ago
- CVE-2025-31250 allowed macOS permission prompts to be spoofed, displaying as one app while applying consent to another.
- The vulnerability exploited the TCC (Transparency, Consent, and Control) system, which manages macOS permissions.
- Apple Events, an old inter-process communication protocol, was involved in the vulnerability due to its integration with TCC.
- A proof-of-concept demonstrated how to spoof TCC prompts, highlighting the ease of exploiting this flaw.
- The vulnerability could be timed to appear when a user opens a trusted app, increasing the chance of tricking them into granting permissions.
- Previous exploits like $HOMERun and powerdir were referenced, showing historical context for TCC vulnerabilities.
- Apple's patch in macOS Sequoia 15.5 addressed the issue by silently dropping malicious TCC messages.
- The article suggests that while the patch is effective, future vulnerabilities in TCC may still emerge.
Deepin Desktop Removed from OpenSUSE Due to Packaging Policy Violation
a year ago
- openSUSE removes Deepin Desktop Environment (DDE) due to packaging policy violations.
- A 'license agreement' in deepin-feature-enable package bypassed security reviews.
- Deepin components like deepin-daemon and file manager skipped formal security checks.
- The bypass was unintentional but violated openSUSE policies, posing security risks.
- Historical issues between openSUSE and Deepin include poor communication and unresolved vulnerabilities.
- openSUSE will remove DDE from Tumbleweed and Leap 16.0; Leap 15.6 loses only deepin-feature-enable.
- Users can manually add Deepin repos but are warned of security risks.
Multiple Security Issues in Screen
a year ago
- Multiple security vulnerabilities identified in Screen versions 4.9.1 and 5.0.0, including a local root exploit (CVE-2025-23395).
- Screen 5.0.0 introduces a default PTY mode change to 0622, making PTYs world-writable (CVE-2025-46803).
- TTY hijacking vulnerability when attaching to multi-user sessions (CVE-2025-46802).
- Information leak via socket lookup error messages in setuid-root context (CVE-2025-46804).
- Race conditions in signal sending mechanisms (CVE-2025-46805).
- Buffer overflow due to improper use of strncpy() in Screen 5.0.0.
- General recommendations include avoiding setuid-root installation and implementing privilege dropping by default.
- Problematic coordinated disclosure process with Screen upstream, leading to delays in patch development and distribution.
- Affected distributions include Arch Linux, Fedora 42, NetBSD 10.1, and others, with varying degrees of impact.
We Fixed 2k+ Security Issues (2023)
a year ago
- Dgraph Labs Inc. implemented Continuous Security Audits to detect and remediate security issues in their OpenSource offerings.
- Integrated toolsets with GitHub Actions for improved visibility and faster resolution of security issues.
- Addressed over 2k+ security issues in ~3 months, enhancing SOC2 compliance.
- Security audits focus on three layers: Code, Binary Artifacts, and Docker Images.
- Code layer audits include dependency package checks (CVEs) and static analysis (Linters).
- Binary Artifacts layer ensures secure environment and SHA validation for integrity.
- Docker Images layer focuses on updated Linux packages to prevent vulnerabilities.
- CVEs (Common Vulnerabilities and Exposures) are identifiers for tracking software vulnerabilities.
- Linters are automated tools for detecting code issues, improving quality and security.
- Continuous Security Audits involve Code & Build Phase (Aqua Trivy Scans) and Post Release Phase (Snyk Scans).
- GitHub Security tab used for visualizing, triaging, and resolving security issues.
- DependaBot enabled for auto-remediation of security issues.
- Tracked fixes via GitHub, showing a decrease in reported issues over time.
- Achieved significant results: resolved 2k+ security issues and 1k+ CVEs across projects.
- Future focus includes exploring AI-driven security tools and auto-remediation solutions.

first prev4next

About|Login

#security

Memory-safe sudo to become the default in Ubuntu

Curl: We still have not seen a single valid security report done with AI help

iVentoy tool injects malicious certificate and driver during Win install

Email and password authentication should be a last resort (rant)

Removal of Deepin Desktop from OpenSUSE Due to Packaging Policy Violation

Open source project curl is sick of users submitting "AI slop" vulnerabilities

Why Intel Deprecated SGX?

The Linux Kernel's PGP Web of Trust

CVE-2025-46336 (rack-session): Rack session gets restored after deletion

Fighting Unwanted Notifications with Machine Learning in Chrome

Using Git-upload-pack for a simpler CI integration

Why not object capability languages?

In defense of self-signed certificates (2013)

Stop Saying "Responsible Disclosure"

Show HN: CLI that spots fake GitHub stars, risky dependencies and licence traps

I hacked a dating app (and how not to treat a security researcher)

Can You Really Trust That Permission Pop-Up on macOS? (CVE-2025-31250)

Deepin Desktop Removed from OpenSUSE Due to Packaging Policy Violation

Multiple Security Issues in Screen

We Fixed 2k+ Security Issues (2023)