Hasty Briefsbeta

All tags

#security

683 stories total

Bilingual

Bitcoin's Security Budget Issue: Problems, Solutions and Myths Debunked
10 months ago
- Bitcoin's security relies on honest miners controlling the majority of computing power.
- A 51% attack can lead to double-spending, transaction censorship, or network halting.
- Bitcoin's security budget consists of block subsidies and transaction fees.
- The block subsidy halves every four years, reducing miner revenue over time.
- Transaction fees have not sufficiently replaced the declining block subsidy.
- Low fees and limited block size hinder Bitcoin's security budget growth.
- Potential solutions include scaling on-chain, changing consensus mechanisms, or altering monetary rules.
- Experts warn of increasing vulnerability to 51% attacks if security budget issues are not addressed.
If you're using Microsoft Authenticator to store your passwords, don't
10 months ago
- Microsoft Authenticator is ending support for password storage.
- New password additions or imports stopped this month.
- Autofill functionality will end in July 2025.
- All passwords will be unavailable starting August 2025.
- Payment information will be deleted after July 2025.
- Unsaved generated passwords will be deleted after August 2025.
- Passkeys will continue to be supported.
- Saved passwords can still be accessed via Microsoft Edge.
- Users may need to consider alternative password managers.
Show HN: A local secrets manager with easy backup
10 months ago
- yacs is a command-line tool for securely storing, managing, and retrieving secrets locally in an encrypted JSON file.
- It uses AES encryption with a master password, employing PBKDF2 for key derivation and a unique salt for enhanced security.
- Features include initialization with a master password and hint, adding and retrieving secrets, viewing keys and descriptions, and resetting the credential store.
- The tool ensures security by verifying the master password after initialization and using a randomly generated IV for each encryption.
- Installation is via pip with the command 'pip install yacs-cli', and it supports commands like init, put, get, view, and reset.
- The project is open-source under the MIT License, welcoming contributions through issues or pull requests.
iOS Activation Flaw Enables Pre-User Device Compromise and Identity Exposure
10 months ago
- A critical vulnerability in Apple’s iOS activation pipeline allows remote XML payload injection before user interaction.
- The flaw involves an unsigned `.plist` configuration payload from `humb.apple.com/humbug/baa` that SetupAssistant processes without verification.
- Attackers can inject arbitrary XML data affecting system trust, network behavior, and identity provisioning persistently.
- The issue was observed in a real-world attack, not simulated, affecting iOS 18.5 devices during factory setup.
- Impact includes pre-user control compromise, persistent `.plist` modifications, and regulatory exposure (GDPR, CMMC 2.0, FedRAMP).
- Technical details show SetupAssistant connects to an unauthenticated endpoint, accepting and applying unverified `.plist` payloads.
- Recommendations include enforcing digital signatures, authentication for endpoints, XML schema validation, and urgent patching.
- Disclosure timeline: Reported to Apple and US-CERT on May 19, 2025; public disclosure on June 26, 2025.
Hack IKKO "AI powered" earbuds to run DOOM, stole OpenAI API key, customer data
10 months ago
- The earbuds run on Android and were purchased for 245 euros after being featured in a Mrwhosetheboss video and on TikTok.
- The device boots to a screen with ChatGPT prominently displayed, and includes other AI features like translations.
- The audio quality is poor with default EQ profiles but can be improved by manually adjusting the EQ curves.
- The device uses modified apps from the IKKO store, as it lacks Google Play Store, and includes apps like Spotify and Subway Surfers.
- ADB was left enabled, allowing for easy sideloading of apps and further investigation into the device's functionality.
- The ChatGPT integration communicates directly with OpenAI, and a ChatGPT API key was found on the device.
- The device logs chats to an endpoint, potentially exposing user data, and lacks proper authentication for some API endpoints.
- A security flaw allowed for the generation of QR codes to bind devices to apps, potentially exposing user chat histories and names.
- After reporting the issues, the company released updates to improve security, but some vulnerabilities remain.
- The device was eventually rooted, revealing further security issues, including an unauthenticated proxy API for ChatGPT.
Is Anybody Using This Private Key
10 months ago
- The website is a meme and not for actual private key submission.
- Users are warned not to submit real private keys or report phishing.
- If a private key is shared, it is no longer secure.
- The site suggests checking if a private key is already taken by pasting it.
CVEs in Bluetooth Headphones and Earbuds
10 months ago
- Vulnerabilities found in Bluetooth headphones and earbuds using Airoha SoCs.
- Attackers can compromise devices within Bluetooth range without authentication.
- Three CVEs identified: CVE-2025-20700, CVE-2025-20701, CVE-2025-20702.
- Affected devices include models from Beyerdynamic, Marshall, Sony, and others.
- Vulnerabilities allow RAM/Flash manipulation, eavesdropping, and impersonation.
- Airoha has released SDK updates; manufacturers are working on patches.
- High-value targets like journalists and diplomats are at higher risk.
- End-users need firmware updates; some vendors may not be aware of using Airoha SoCs.
- Disclosure timeline includes reporting to Airoha and vendors, with patches expected.
Crypto 101 – Introductory course on cryptography
10 months ago
- Crypto 101 is a free introductory course on cryptography for programmers of all skill levels.
- Covers essential cryptographic concepts like block ciphers, stream ciphers, hash functions, MACs, public key encryption, key agreement protocols, and signature algorithms.
- Teaches how to exploit cryptographic flaws using programming skills.
- Includes practical applications such as forging cookies, password recovery, and backdooring random number generators.
- Available in multiple DRM-free formats.
- Originated from a PyCon 2013 presentation and expanded into a book focusing on breaking cryptography.
Who Cracked Bitcoin July 4th? 80k BTC Moved in What Might Be First Real Exploit
10 months ago
- 80,000 BTC (worth $8.6 billion) were moved from 8 untouched wallets on July 4, 2025.
- The wallets had been inactive for over 14 years, each containing exactly 10,000 BTC.
- The transfers were perfectly coordinated, suggesting a deliberate act rather than a random event.
- The wallets were all P2PKH (legacy format) and likely generated with flawed randomness in 2010–2011.
- On-chain messages included legal notices and a reference to the TV series 'Lost' numbers (4, 8, 15, 16, 23, 42).
- The operation may exploit weak key generation in early Bitcoin wallets, challenging the security of dormant funds.
- A legal framework was presented, claiming the funds as 'abandoned' and requiring proof of ownership by September 30.
- The event raises concerns about the security of legacy Bitcoin addresses and the inviolability of private keys.
- Potential market impacts include panic sell-offs and mass migration from P2PKH to more secure wallet formats.
- The incident serves as a warning about cryptographic vulnerabilities in early Bitcoin wallets.
Helm local code execution via a malicious chart – CVE-2025-53547
10 months ago
- A Helm contributor discovered a vulnerability where a specially crafted Chart.yaml and Chart.lock file can lead to local code execution during dependency updates.
- The vulnerability involves symlinked Chart.lock files, which, when updated, can write malicious content to executable files like bash.rc or shell scripts.
- This issue affects Helm when running commands like 'helm dependency update' or when the Helm SDK's downloader Manager performs an update.
- The vulnerability has been patched in Helm v3.18.4.
- A workaround is to ensure the Chart.lock file is not a symlink before updating dependencies.
- The security issue was disclosed by Jakub Ciolek at AlphaSense.
Jurisdiction Is Nearly Irrelevant to the Security of Encrypted Messaging Apps
10 months ago
- Properly built cryptography means the hosting country of ciphertext doesn't matter for security.
- Key management, transparency logs (Key Transparency, Binary Transparency), and reproducible builds are essential for secure messaging apps.
- End-to-end encryption protocols like MLS and Signal Protocol must be implemented without tolerating plaintext transmission.
- Independent third-party monitors are crucial for verifying transparency logs and ensuring security.
- Jurisdiction is a minor concern if cryptography is correctly implemented, as metadata is the only accessible data.
- Government backdoor attempts can be detected through binary transparency and reproducible builds.
- Signal is close to being a proper implementation but lacks key transparency and third-party build verification.
- Data sovereignty is a preference, not a cryptographic security consideration.
"Just Fucking Ship It" (Or: On Vibecoding)
10 months ago
- Author attended a hackathon where they encountered an AI tutor app called Mentora, which later evolved into a social media app named Pandu.
- Pandu's iOS app was decrypted and analyzed, revealing client-side handling of OpenAI API keys and system prompts.
- Supabase was used as a backend, but misconfigurations allowed unauthorized access to database relations, exposing sensitive user data.
- Exposed data included user profiles, push notification tokens, chat requests, and live geographic locations, raising serious privacy concerns.
- The app's architecture allowed for manipulation, such as sending arbitrary push notifications and accessing private user information.
- Nearly 10,000 users signed up for Pandu, including minors, with their personal data exposed due to poor security practices.
- The creator of Pandu, Christian, was criticized for incompetence and recklessness, with the app posing significant privacy risks.
- Users were urged to stop supporting the app, report it, and remove friends and loved ones from the platform due to its dangers.
Browser extensions turn nearly 1M browsers into website-scraping bots
10 months ago
- Extensions installed on nearly 1 million devices bypass security protections to scrape websites for a paid service.
- 245 extensions across Chrome, Firefox, and Edge use MellowTel-js, a library enabling monetization via web scraping.
- MellowTel is linked to Olostep, a web scraping API that distributes requests via these extensions.
- Extensions serve varied purposes (bookmarking, volume boosting, etc.) but share the MellowTel integration.
- Olostep claims to evade bot detection and handle up to 100K parallel requests quickly.
- MellowTel's founder states the library shares user bandwidth for scraping public data, with developers earning 55% of revenue.
Magic .env files built for sharing: Human-first, AI-friendly
10 months ago
- Magic .env files designed for sharing with a human-first, AI-friendly approach.
- Use @decorator comments in .env files to create a declarative schema and securely load secrets from external sources.
- Provides powerful validation capabilities to catch misconfiguration errors early with clear messages.
- Automatically generates type-safety according to the schema, eliminating manual type writing.
- Enhances security by redacting secrets in stdout and global console methods to prevent leaks.
- Supports composing defaults, environment-specific .env files, and local git-ignored overrides.
- Allows reading from any external secret provider via CLI commands.
- Acts as a drop-in replacement for dotenv, requiring minimal changes for validation, security, and more.
Security Issues Regarding GSMA ESIMs / EUICCs and Javacard
10 months ago
- Security researcher Adam Gowdiak identified flaws in eUICCs (eSIM chips) within the GSMA architecture, particularly in Javacard implementations.
- The issue stems from the reliance on off-card bytecode verification, which is impractical for resource-constrained microcontrollers used in eUICCs.
- Javacard was initially designed for banking, where a single entity (the bank) controls applet loading, ensuring security via off-card verification.
- The eSIM architecture introduces multiple stakeholders (MNOs/MVNOs), making off-card verification unsafe as not all can be trusted to perform it correctly.
- Oracle and Gemalto downplayed similar findings in 2019, leading to insufficient industry awareness of the risks.
- The GSMA eSIM standard allows multiple operators to load applets, increasing the risk of adversarial actions without on-card verification.
- Mitigations like TS.48 key diversification address specific attack vectors but don't solve the broader architectural issue.
- Oracle should improve its reference implementation to include robust on-card verification for resource-constrained environments.
- GSMA should enforce security requirements, mandate on-card verification, and refuse accreditation for eUICCs relying on off-card verification.
- The industry should move beyond Javacard or any technology requiring complex on-card verification that exceeds microcontroller capabilities.
aileaks.dev - Community driven database of AI related security incidents
10 months ago
- A community-driven database of AI-related security incidents.
- Allows users to submit incidents for review.
- Displays loading status while fetching incidents.
Chrome's hidden X-Browser-Validation header reverse engineered
10 months ago
- Chrome added new headers including 'x-browser-validation' which appears to be a hash.
- The 'x-browser-validation' header is likely used for integrity checks like verifying user agent authenticity.
- The header is generated by concatenating a platform-specific API key with the user agent string, hashing with SHA-1, and base64 encoding the result.
- Different API keys are used for Windows, Linux, and macOS platforms.
- The process involves data preparation, hashing with SHA-1, and base64 encoding before setting the header.
Two high-severity patches are coming to Node.js on Tuesday
10 months ago
- Node.js to release new versions for 24.x, 22.x, and 20.x release lines on or shortly after July 15, 2025.
- Addresses 2 high severity issues in 24.x, 1 in 22.x, and 1 in 20.x.
- End-of-Life versions remain affected; users should update to secure versions.
- Releases will be available on or shortly after July 15, 2025.
- Security policy and vulnerability reporting details provided.
- Subscribe to nodejs-sec mailing list for updates on security vulnerabilities.
How secure is your Bitcoin wallet's mnemonic seed phrase?
10 months ago
- Bitcoin wallet security relies on a unique mnemonic phrase (12 or 24 words) derived from high entropy.
- BIP39 mnemonics encode everything needed for a Bitcoin wallet without third-party authentication.
- Changing even a single letter in a mnemonic phrase invalidates it due to strict BIP39 rules.
- Entropy for mnemonics is generated using cryptographically secure random number generators.
- 128, 192, or 256 bits of entropy correspond to 12, 18, or 24-word phrases respectively.
- The scale of Bitcoin's keyspace is vast, with 256-bit entropy comparable to atoms in the observable universe.
- BIP39 mnemonics use a 2048-word list, ensuring uniqueness and error resistance via checksums.
- SHA-256 hashing is used to create a checksum for validating mnemonic phrases.
- Hierarchical Deterministic (HD) wallets derive all keys and addresses from a single mnemonic seed.
- Passphrases add an extra security layer but can lead to irreversible loss if forgotten.
OpenAI Vulnerability: 48 Days, No Response
10 months ago
- A vulnerability was reported to OpenAI on 29 May 2025, allowing unauthorized access to other users' chat responses.
- The issue remains unpatched as of 16 July 2025, with no human follow-up from OpenAI.
- The vulnerability was reported via encrypted email instead of OpenAI's bug bounty platform due to restrictive non-disclosure terms.
- The researcher followed a 45-day disclosure window before making a limited public disclosure.
- Recommendations for vendors include staffing security inboxes with humans, publishing clear response policies, and rewarding researchers.
- Users are advised to exercise caution as the vulnerability has not been fixed.

first prev9next

About|Login

#security

Bitcoin's Security Budget Issue: Problems, Solutions and Myths Debunked

If you're using Microsoft Authenticator to store your passwords, don't

Show HN: A local secrets manager with easy backup

iOS Activation Flaw Enables Pre-User Device Compromise and Identity Exposure

Hack IKKO "AI powered" earbuds to run DOOM, stole OpenAI API key, customer data

Is Anybody Using This Private Key

CVEs in Bluetooth Headphones and Earbuds

Crypto 101 – Introductory course on cryptography

Who Cracked Bitcoin July 4th? 80k BTC Moved in What Might Be First Real Exploit

Helm local code execution via a malicious chart – CVE-2025-53547

Jurisdiction Is Nearly Irrelevant to the Security of Encrypted Messaging Apps

"Just Fucking Ship It" (Or: On Vibecoding)

Browser extensions turn nearly 1M browsers into website-scraping bots

Magic .env files built for sharing: Human-first, AI-friendly

Security Issues Regarding GSMA ESIMs / EUICCs and Javacard

aileaks.dev - Community driven database of AI related security incidents

Chrome's hidden X-Browser-Validation header reverse engineered

Two high-severity patches are coming to Node.js on Tuesday

How secure is your Bitcoin wallet's mnemonic seed phrase?

OpenAI Vulnerability: 48 Days, No Response