#security

Presigned URLs are replay attacks by design, but object storage systems like Tigris turn this into a feature by signing time into requests. Signatures expire within minutes, avoiding complex nonce coordination. Tradeoffs include no per-URL revocation, unlimited reuse before expiry, and unavoidable leakage, but self-destructing URLs make them practical for access control.

The article discusses remote attestation, a security mechanism that allows a remote system to verify the integrity of another system's hardware and software state. It explains how attestation uses cryptographic signatures and trusted platform modules to detect tampering or unauthorized changes. The piece covers applications in cloud computing, IoT devices, and confidential computing environments.

An investigation reveals that Ghislaine Maxwell's father, Robert Maxwell, sold bugged Israeli software to two U.S. nuclear weapons laboratories, raising national security concerns. The software was designed to intercept data, potentially allowing Israel access to sensitive nuclear weapons information from the labs.

KASAN detects memory bugs in the Linux kernel using compiler instrumentation, memory poisoning, redzones around allocations, and a shadow memory map to track valid and invalid memory areas at runtime.

The website StrongPhrase.net provides a tool for generating strong, memorable passphrases by combining random words, helping users improve online security without relying on hard-to-remember complex passwords.

The SoC 2 Guide helps businesses understand what SOC 2 compliance entails, including the requirements and associated costs. It breaks down the process for companies needing a SOC 2 report.

This guide explains what an API key is and provides step-by-step instructions for generating one through a developer dashboard, including navigating settings, creating a new key, naming it, and securely copying and storing the generated key for use in API authentication.

The uBlock Origin Chrome extension has been updated to block known ClickFix sites, which are malicious websites that use social engineering to trick users into clicking and running harmful code. This move helps mitigate ClickFix attacks, a growing threat where fake error messages prompt users to copy-paste or execute malicious scripts.

President Trump returned to the US on an older Air Force One aircraft amid reported threats from Iran. The decision to use a backup plane came as the administration addressed security concerns related to potential Iranian retaliation following a US airstrike that killed a top Iranian general.

OpenMandriva reported that its website and source code infrastructure were targeted in an attempted sabotage attack. The project stated that the attack was detected early and mitigated, with no compromise to distribution integrity or user data confirmed. The team thanked the community for vigilance and announced they are reviewing security measures.

Zcash's formal verification efforts have eliminated undetectable counterfeiting bugs from the new Ironwood pool, ruling out such vulnerabilities up to the underlying cryptographic assumptions, as part of Project Tachyon.

The web server and proxy software Nginx has been affected by several recent Common Vulnerabilities and Exposures (CVEs). Given that Nginx is commonly exposed directly to the internet as an ingress or load balancer, the discussion raises questions about how concerned corporate environments should be about these security flaws.

BlackBear presents itself as a "Private Life Operating System," a platform designed to help users manage their personal data, finances, and digital identity with a focus on privacy and security.

BareMetal RAM Dumper is a bare-metal x86 tool designed for Cold Boot Attack experiments. It runs without an operating system to dump the contents of RAM, allowing researchers to study memory persistence after a reboot.

A GitHub repository has reverse-engineered Google's reCAPTCHA system, detailing how the CAPTCHA challenge-response mechanism works internally and providing technical analysis of its operation.

Proton's claim that its crypto is "Transparent and OPAQUE" is misleading: while it uses the OPAQUE protocol for authentication, its encryption system lacks full transparency and verifiability compared to the OPAQUE standard.

Developers frequently ignore or mishandle OpenSSL function return values, causing incomplete error handling that can lead to security vulnerabilities and silent data corruption across many codebases.

A developer claims Google alerted him to a potential account hijack but still charged him over $11,000 for cloud services used by the attacker. He argues the company should have prevented or reversed the fraudulent charges after issuing the security warning.

A vulnerability was discovered in the Meccha Chameleon remote administration tool that allows an attacker to execute arbitrary code on a target system with just two clicks, posing a significant security risk to users of the software.

Daniel Stenberg released the "Mythos Report for Curl," a document addressing common misconceptions and myths surrounding the curl and libcurl project, clarifying facts about its development, security, and maintenance.

The article recounts the author's early journey into automated smart contract testing, describing how they developed a tool called GASER to find gas-cost vulnerabilities in Ethereum smart contracts. The post details the initial spark of the idea, the technical challenges faced, and the early experimental results from the project.

SYR-ROOT's Reverse OTP Protocol is a security mechanism that reverses the traditional one-time password flow, enhancing authentication security by having the server generate and validate OTPs in a novel way.

Troy Hunt compares deleting personal data from the internet to removing pee from a swimming pool—once it's in, it's nearly impossible to eliminate. Data spreads across multiple broker sites, and opt-out processes are often ineffective and require constant repetition.

China's Alibaba Group plans to ban the use of Claude Code, an AI coding assistant developed by Anthropic, in its workplace over alleged backdoor security risks, according to a source familiar with the matter. The decision follows concerns that the tool could pose data security threats.

The GNU Guix project disclosed security vulnerabilities affecting 'guix substitute' and 'guix pull' commands, which could potentially allow attackers to compromise system integrity during package substitution and update processes.

Thieves stole $1.3 million worth of Nvidia and AMD GPUs from a San Francisco data center by posing as legitimate contractors, highlighting the vulnerability of AI infrastructure to cargo theft and the lack of security protocols around high-value hardware.

The Intercept lost control of its Signal-based tip line for months, according to a report.

Fedora 45 is evaluating the possibility of enabling x86_64 Shadow Stack technology by default to improve security against control-flow hijacking attacks. This hardware-backed protection mechanism would help prevent return-oriented programming (ROP) and other memory corruption exploits on compatible Intel and AMD processors.

The Linux Foundation has introduced a new initiative that uses the Domain Name System (DNS) to provide AI agents with trusted digital identities, aiming to improve security and verifiability for autonomous systems operating online.

A security vulnerability in KDE Plasma allows arbitrary code execution that can break out of sandbox protections, potentially compromising system security.