links.lmorchard.com

#security

177 bookmarks tagged with #security · RSS Feed · ← All Tags

AI models may be capable of self-replicating without access to a datacenter \ Anthropic

https://www.anthropic.com/research/self-replicating-ai
Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial IoT devices, like smart ovens and off-brand Android TV boxes. A replicator like this would be challenging to shut down, since there’s no centralized point to shut off - though it may be slow (with a doubling time of days). Unlike non-AI malware, it could also figure out unfamiliar devices on its own. In our evals, a 9B model got inference running on 8 of the 9 hardware types we tested.
#ai #botnets #llms #security #worms
archive.org #38805

Disable Yubikey from typing gibberish on Mac : r/yubikey

https://www.reddit.com/r/yubikey/comments/1k6k5pv/disable_yubikey_from_typing_gibberish_on_mac/
Long-pressing a Yubikey Nano will generate a 44-character random-looking string like "ccccccjlkgjlevtdernkbbnrrvhcvgbljgchbgbdbvgk" as an OTP token because it emulates a keyboard. This is really annoying for Yubikey Nano, which you can leave plugged into your laptop at all times, and gets sporadically triggered by my lap, which my laptop sits on for a long time. I wanted to disable this. Unfortunately, Yubikey Manager is deprecated, so the existing Reddit documentation doesn't help. Instead: - Install Yubikey Manager - Click "Toggle Applications" (see https://imgur.com/a/rhvcPlE) - Uncheck "Yubico OTP" (see https://imgur.com/a/rhvcPlE)
#security #tools #utils #yubikey
archive.org #38781

Password Protecting Static Site Content with WASM

https://al9000.com/rust/wasm/static-site-file-decryption/
I use static site generators for my sites. I call out to external APIs to do anything dynamic. The exception is password protection. I'd always thought that needed to be done dynamically on a site's host server. I realized with WASM that's not the case. Files can be encrypted and served statically with a WASM process providing decryption directly on the front end.
#metablogging #security #ssg #static #wasm #webdev
archive.org #38451

Discovering Negative-Days with LLM Workflows | Spaceraccoon's Blog

https://spaceraccoon.dev/discovering-negative-days-llm-workflows/
With this little experiment, I validated a critical threat intelligence workflow - we need to be monitoring for open-source vulnerabilities before (or if ever) a CVE is published. Threat actors are 100% already doing this in some form to quickly weaponise and exploit open-source issues. To emphasise the point: This is already happening.
#ai #llms #security
archive.org #38299

I got hacked, my server started mining Monero this morning. | Unfinished Side Projects

https://blog.jakesaunders.dev/my-server-started-mining-monero-this-morning/
TL;DR Umami analytics (built with Next.js) had an RCE vulnerability. Got exploited, installed cryptominers Mined Monero for 10 days at 1000%+ CPU Container isolation saved me because it ran as non-root with no mounts Fix: docker rm umami and enable firewall Lesson: Know what your dependencies are built with, and configure containers properly
#containers #dev #docker #nextjs #security #umami
archive.org #38135

We should all be using dependency cooldowns

https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns
Dependency cooldowns are a free, easy, and incredibly effective way to mitigate the large majority of open source supply chain attacks. More individual projects should apply cooldowns (via tools like Dependabot and Renovate) to their dependencies, and packaging ecosystems should invest in first-class support for cooldowns directly in their package managers.
#dependencies #dev #security
archive.org #38016

I don’t want AI agents controlling my laptop – Sophie Alpert

https://sophiebits.com/2025/09/09/ai-agents-security
There’s no good way to say “allow access to everything on my computer, except for my password manager, my bank, my ~/.aws/credentials file, and the API keys I left in my environment variables”. Especially with Simon Willison’s lethal trifecta, you don’t really want to be giving access to these things, even if most of the time, nothing bad happens.
#ai #claude #codegen #llms #security
archive.org #34112

Anyone with 14.7.1. Does it have the equivalent Sequoia non-developer app lockout? | MacRumors Forums

https://forums.macrumors.com/threads/anyone-with-14-7-1-does-it-have-the-equivalent-sequoia-non-developer-app-lockout.2441433/
Sequoia 15.1 now hard-locks out any app that is not approved by Apple, including a bunch of my old and well used utilities. They can be made to run by hacking underneath in BSD, but the situation is unsatisfactory for a computer that I consider is MINE.
#apple #macos #security
archive.org #29925

Apple Forces The Signing Of Applications In MacOS Sequoia 15.1 | Hackaday

https://hackaday.com/2024/11/01/apple-forces-the-signing-of-applications-in-macos-sequoia-15-1/
Many MacOS users are probably used by now to the annoyance that comes with unsigned applications, as they require a few extra steps to launch them. This feature is called Gatekeeper and checks for an Apple Developer ID certificate. Starting with MacOS Sequoia 15, the easy bypassing of this feature with e.g. holding Control when clicking the application icon is now no longer an option, with version 15.1 disabling ways to bypass this completely. Not unsurprisingly, this change has caught especially users of open source software like OpenSCAD by surprise, as evidenced by a range of forum posts and GitHub tickets.
#apple #foss #mac #macos #security
archive.org #29926

Open-Source LLMs - Schneier on Security

https://www.schneier.com/blog/archives/2023/06/open-source-llms.html
We have entered an era of LLM democratization. By showing that smaller models can be highly effective, enabling easy experimentation, diversifying control, and providing incentives that are not profit motivated, open-source initiatives are moving us into a more dynamic and inclusive AI landscape. This doesn’t mean that some of these models won’t be biased, or wrong, or used to generate disinformation or abuse. But it does mean that controlling this technology is going to take an entirely different approach than regulating the large players.
#ai #imported:pinboard #llm #ml #opensource #security
archive.org #29339

The Facebook Hack Is an Internet-Wide Failure | WIRED

https://www.wired.com/story/facebook-hack-single-sign-on-data-exposed/
On Friday, Facebook announced that hackers had leveraged three separate bugs to collect 50 million users’ so-called access tokens, which are the equivalent of digital keys to a Facebook account. With those tokens, hackers can take full control of users’ Facebook accounts, but because of Single Sign-On, they can also access any other website that those 50 million users log into with Facebook.
#facebook #imported:pinboard #oops #security
archive.org #31250

The Facebook Hack Is an Internet-Wide Failure | WIRED

https://www.wired.com/story/facebook-hack-single-sign-on-data-exposed
On Friday, Facebook announced that hackers had leveraged three separate bugs to collect 50 million users’ so-called access tokens, which are the equivalent of digital keys to a Facebook account. With those tokens, hackers can take full control of users’ Facebook accounts, but because of Single Sign-On, they can also access any other website that those 50 million users log into with Facebook.
#facebook #oops #security
archive.org #27923

A Few Thoughts on Cryptographic Engineering: On the NSA

http://blog.cryptographyengineering.com/2013/09/on-nsa.html
All of this is a long way of saying that I was totally unprepared for today's bombshell revelations describing the NSA's efforts to defeat encryption. Not only does the worst possible hypothetical I discussed appear to be true, but it's true on a scale I couldn't even imagine. I'm no longer the crank. I wasn't even close to cranky enough.
#crypto #imported:pinboard #nsa #privacy #security
archive.org #24162

Crypto prof asked to remove NSA-related blog post | Ars Technica

http://arstechnica.com/security/2013/09/crypto-prof-asked-to-remove-nsa-related-blog-post/
Today, Green's academic dean contacted him to ask that "all copies" of the blog post be removed from university servers. Green said that the move was not "my Dean's fault," but he did not elaborate. Were cryptology professors at Johns Hopkins not allowed to say, as Green had, things like:
#academia #crypto #fairuse #imported:pinboard #nsa #security #tech
archive.org #32161

Crypto prof asked to remove NSA-related blog post | Ars Technica

http://arstechnica.com/security/2013/09/crypto-prof-asked-to-remove-nsa-related-blog-post
Today, Green's academic dean contacted him to ask that "all copies" of the blog post be removed from university servers. Green said that the move was not "my Dean's fault," but he did not elaborate. Were cryptology professors at Johns Hopkins not allowed to say, as Green had, things like:
#academia #crypto #fairuse #nsa #security #tech
archive.org #24161

A Few Thoughts on Cryptographic Engineering: A note on the NSA, the future, and fixing mistakes

http://blog.cryptographyengineering.com/2013/09/a-note-on-nsa-future-and-fixing-mistakes.html
The question to me -- as an American and as someone who cares about the integrity of speech -- is how we restore faith in our technology. I don't have the answers to this question right now. Unfortunately this is a long-term problem that will consume the output of researchers and technologists much more talented than I am. I only hope to be involved in the process.
#academia #crypto #imported:pinboard #nsa #security #tech #to:fb
archive.org #24160

Persona and Surveillance - Identity at Mozilla

http://identity.mozilla.com/post/52729477874/persona-and-surveillance
It’s also worth pointing out that we do take certain technical measures to limit the data we collect. We’ve designed Persona so that the identity provider – including the fallback Identity Provider that we run – does not learn your browsing history. We consider that a good security practice, not specifically because of surveillance, but generally because collecting data without a user benefit just creates risk.
#imported:pinboard #mozilla #persona #privacy #security #to:fb #web #webdev
archive.org #23769

Meet the men who spy on women through their webcams | Ars Technica

http://arstechnica.com/tech-policy/2013/03/rat-breeders-meet-the-men-who-spy-on-women-through-their-webcams/
If you are unlucky enough to have your computer infected with a RAT, prepare to be sold or traded to the kind of person who enters forums to ask, "Can I get some slaves for my rat please? I got 2 bucks lol I will give it to you :b" At that point, the indignities you will suffer—and the horrific website images you may see—will be limited only by the imagination of that most terrifying person: a 14-year-old boy with an unsupervised Internet connection.
#imported:pinboard #privacy #rat #ratters #security #to:fb
archive.org #32418

Meet the men who spy on women through their webcams | Ars Technica

http://arstechnica.com/tech-policy/2013/03/rat-breeders-meet-the-men-who-spy-on-women-through-their-webcams
If you are unlucky enough to have your computer infected with a RAT, prepare to be sold or traded to the kind of person who enters forums to ask, "Can I get some slaves for my rat please? I got 2 bucks lol I will give it to you :b" At that point, the indignities you will suffer—and the horrific website images you may see—will be limited only by the imagination of that most terrifying person: a 14-year-old boy with an unsupervised Internet connection.
#privacy #rat #ratters #security #to:fb
archive.org #23466

google-authenticator - Two-step verification - Google Project Hosting

http://code.google.com/p/google-authenticator
The Google Authenticator project includes implementations of one-time passcode generators for several mobile platforms, as well as a pluggable authentication module (PAM). One-time passcodes are generated using open standards developed by the Initiative for Open Authentication (OATH) (which is unrelated to OAuth).
#authentication #crypto #google #security
archive.org #20621

Does Airport Security Really Make Us Safer? | Culture | Vanity Fair

http://www.vanityfair.com/culture/features/2011/12/tsa-insanity-201112
The best memorial to the victims of 9/11, in Schneier’s view, would be to forget most of the “lessons” of 9/11. “It’s infuriating,” he said, waving my fraudulent boarding pass to indicate the mass of waiting passengers, the humming X-ray machines, the piles of unloaded computers and cell phones on the conveyor belts, the uniformed T.S.A. officers instructing people to remove their shoes and take loose change from their pockets. “We’re spending billions upon billions of dollars doing this—and it is almost entirely pointless. Not only is it not done right, but even if it was done right it would be the wrong thing to do.”
#911 #flight #security #terror #terrorism #travel
archive.org #20311

Hackers hit supermarket self-checkout lanes, steal money from shoppers

http://arstechnica.com/business/news/2011/12/hackers-hit-supermarket-self-checkout-lanes-steal-money-from-shoppers.ars
Lucky Supermarkets has removed the tampered card readers, which were made by VeriFone, in the stores known to be affected and says it is enhancing security of every credit and debit card reader in all 234 of its stores. Joseph Steinberg, CEO of the security company Green Armor Solutions, released a statement saying "Everyone should always check any device in which they insert/swipe a credit/debit/ATM card, or to which they touch their card, to see if it looks like it may have been modified/covered."
#holyshit #identity #security #selfcheckout #skimmers #theft
archive.org #20174

Full disk encryption is too good, says US intelligence agency | ExtremeTech

http://www.extremetech.com/computing/105931-full-disk-encryption-is-too-good-says-us-intelligence-agency
It’s a tough situation: On the one hand, being able to crack full disk encryption is vital for the prosecution of white-collar criminals, child porn ringleaders, pharmaceutical spam barons, and the curtailment of terrorism — but on the other, it’s quite satisfying to know that, perhaps at long last, we have a way of escaping the ireful eye of Big Brother. Where do you stand on FDE?
#encryption #law #security
archive.org #19777

Stop Sharing Your Files When You Travel

http://www.readwriteweb.com/hack/2011/11/stop-sharing-your-files-when-y.php
I have been on the road a lot in the past several months, and one thing I keep seeing is that folks are over-sharing. I am not talking about putting up those ribald pictures on your Facebook account, or forwarding those questionable email "jokes." But literally sharing your computer's data files across the hotel (and some airports too). Here is what my Mac Finder looks like at a Hilton that I was at earlier in the week (you can see that I am connected to several of my fellow travelers' PCs):
#mac #networking #security #tech
archive.org #19309

Ksplice » Hijacking HTTP traffic on your home subnet using ARP and iptables - System administration and software blog

http://blog.ksplice.com/2010/09/hijacking-http-traffic-on-your-home-subnet-using-arp-and-iptables
"Let’s talk about how to hijack HTTP traffic on your home subnet using ARP and iptables. It’s an easy and fun way to harass your friends, family, or flatmates while exploring the networking protocols."
#arp #hacks #hijack #http #iptables #networking #security
archive.org #14383

Cross-domain Ajax with Cross-Origin Resource Sharing | NCZOnline

http://www.nczonline.net/blog/2010/05/25/cross-domain-ajax-with-cross-origin-resource-sharing
"A couple of years ago, web developers were banging their head against the first wall in Ajax: the same-origin policy. While we marveled at the giant step forward enabled by cross-browser support for the XMLHttpRequest object, we quickly bemoaned the fact that there was no way to make a request to a different domain from JavaScript. Everyone setup proxies on their web sites, which was the onset of a new host of open redirect problems, as a way to get around the restriction. Although developers were working around this limitation using server-side proxies as well as other techniques, the community outcry was around allowing native cross-domain Ajax requests. A lot of people are unaware that almost all browsers (Internet Explorer 8+, Firefox 3.5+, Safari 4+, and Chrome) presently support cross-domain Ajax via a protocol called Cross-Origin Resource Sharing."
#ajax #cors #crossdomain #security #webdev
archive.org #13743

support : SAML toolkit for Ruby on Rails

http://support.onelogin.com/entries/165434-saml-toolkit-for-ruby-on-rails
"Security Assertion Markup Language (SAML) is a standard for logging users into applications based on their session in another context. This has significant advantages over logging in using a username/password: no need to type in credentials, no need to remember and renew password, no weak passwords etc."
#saml #security #webdev
archive.org #13435

Stunnel.org

http://www.stunnel.org/examples/generic_tunnel.html
"Lets say you want to use POP from your local machine to a remote machine, but don't have an SSL aware email client. What you can do is to have your machine talk to stunnel on the local machine, who then encrypts the packets and sends them another stunnel running on the remote machine, which forwards them in clear text to the POP server on that machine. "
#encryption #networking #security #ssl #stunnel
archive.org #13230

RANDOM.ORG - True Random Number Service

http://www.random.org
"Perhaps you have wondered how predictable machines like computers can generate randomness. In reality, most random numbers used in computer programs are pseudo-random, which means they are a generated in a predictable fashion using a mathematical formula. This is fine for many purposes, but it may not be random in the way you expect if you're used to dice rolls and lottery drawings."
#entropy #math #mathematics #nifty #numbers #random #science #security #statistics
archive.org #12911

Undressing the Terror Threat - WSJ.com

http://online.wsj.com/article/SB10001424052748704130904574644651587677752.html
"No amount of statistical evidence, however, will make any difference to those who give themselves over to almost completely irrational fears. Such people, and there are apparently a lot of them in America right now, are in fact real victims of terrorism. They also make possible the current ascendancy of the politics of cowardice—the cynical exploitation of fear for political gain. ... It's a remarkable fact that a nation founded, fought for, built by, and transformed through the extraordinary courage of figures such as George Washington, Susan B. Anthony and Martin Luther King Jr. now often seems reduced to a pitiful whimpering giant by a handful of mostly incompetent criminals, whose main weapons consist of scary-sounding Web sites and shoe- and underwear-concealed bombs that fail to detonate."
#america #cowardice #fear #politics #risk #security #terror #terrorism
archive.org #12750

What Airline Passengers Can Learn - TIME

http://www.time.com/time/nation/article/0,8599,1950576,00.html
"This now familiar ritual distracts us from the real lesson, which is that we are not helpless. And since regular people will always be first on the scene of terrorist attacks, we should perhaps prioritize the public's antiterrorism capability — above and beyond the fancy technology that will never be foolproof. By definition, terrorism succeeds by making us feel powerless. It is more often a psychological threat than an existential one"
#helplessness #homelandsecurity #security #terror #terrorism #travel
archive.org #12716

thestar.com iPhone : The 'Israelification' of airports: High security, little bother

http://www.thestar.com/iphone/news/world/article/744199---israelification-high-security-little-bother
""Do you know why Israelis are so calm? We have brutal terror attacks on our civilians and still, life in Israel is pretty good. The reason is that people trust their defence forces, their police, their response teams and the security agencies. They know they're doing a good job. You can't say the same thing about Americans and Canadians. They don't trust anybody," Sela said. "But they say, 'So far, so good'. Then if something happens, all hell breaks loose and you've spent eight hours in an airport. Which is ridiculous. Not justifiable"
#air #israel #security #terrorism #travel
archive.org #12711

Ralph Schindler - Dynamic Assertions for Zend_Acl in ZF

http://ralphschindler.com/2009/08/13/dynamic-assertions-for-zend_acl-in-zf
"In plain English, what developers want to be able to do is be able to design assertions that can accept application models that implement the Resource or Role interface, and be able to apply some dynamic or custom logic to assess whether or not the given role has access to the given resource. ... For the purposes of this example, we’ll take a simple concept: a user needs to be able to only edit their own blog post. The user in this case, would be our applications model for users. The actual class will implement the Zend_Acl_Role_Interface. We will also have a BlogPost model which will serve as the resource in question, thus implementing the Zend_Acl_Resource_Interface"
#acls #php #security #tutorial #webdev #zend #zendframework
archive.org #12648

OSX.Loosemaque: It’s Not Just a Game Anymore | Symantec Connect

http://www.symantec.com/connect/blogs/osxloosemaque-it-s-not-just-game-anymore
Must be a slow day on the OS X malware front. This is really reaching... "What’s interesting is that the author of this “game” flat-out says what it does on his Web site. Reading through the author’s description, it seems that he has created this game/threat as some sort of artistic project. The aliens are your files and there are consequences for “killing” them."
#games #gaming #indie #osx #security #symantec
archive.org #12624

hackademix.net » Dear Adblock Plus and NoScript Users, Dear Mozilla Community

http://hackademix.net/2009/05/04/dear-adblock-plus-and-noscript-users-dear-mozilla-community
"I abused the power and wasted the enormous trust capital gained by the NoScript add-on through the years to prevent Adblock Plus from blocking stuff on four internet domains of mine, without asking an explicit preemptive user consent." The rest of the blog entry is basically sorry-but-not-really.
#addons #firefox #mozilla #noscript #security
archive.org #12194

Adblock Plus and (a little) more: Displaying web content in an extension - without security issues

http://adblockplus.org/blog/displaying-web-content-in-an-extension-without-security-issues
"Over the last few years I reported a bunch of security vulnerabilities in various extensions and by far the most common issue was: “Extension Foo allows execution of remote code in privileged context”. Typically, an RSS reader extension would take the content of the RSS feed (HTML code), format it nicely and insert into the extension window. The issue that is overlooked here is that the RSS feed could contain some JavaScript code and it would then execute with the privileges of the extension — meaning for example that it would get full access to the browser (cookies, history etc) and to user’s files. pdp discovered a similar issue in the Firebug extension that uses an HTML-based templating system and forgot to sanitize some input received from the webpage."
#extensions #firefox #mozilla #security
archive.org #11950

Microsoft Internet Explorer users told to switch browsers over 'zero-day' flaw | Technology | guardian.co.uk

http://www.guardian.co.uk/technology/2008/dec/16/internet
"Microsoft is trying to put together a patch, but in the meantime computer users have been advised to update their security settings or switch to unaffected browsers such as Firefox or Opera. ... The flaw in IE allows criminals to gain control of computers that have visited a website infected with malicious code designed to exploit it. While restricting web surfing to trusted sites should reduce the risk of infection, the malicious code can be injected into any website. Users do not have to click or download anything to become infected, merely visiting an infected website is sufficient."
#MSFT #browsers #diaf #exploits #microsoft #msie #security #zeroday
archive.org #11784

Amazon.com: Playmobil Security Check Point: Toys & Games

http://www.amazon.com/Playmobil-3172-Security-Check-Point/dp/B0002CYTL2/lewrockwell
"The woman traveler stops by the security checkpoint. After placing her luggage on the screening machine, the airport employee checks her baggage. The traveler hands her spare change and watch to the security guard and proceeds through the metal detector. With no time to spare, she picks up her luggage and hurries to board her flight! "
#checkpoint #playmobil #security #toys #wtf
archive.org #11779

Secret Geek A-Team Hacks Back, Defends Worldwide Web

http://www.wired.com/techbiz/people/magazine/16-12/ff_kaminsky?currentPage=all
"Or, for the sheer geeky joy of it, he could reroute all of .com into his laptop, the digital equivalent of channeling the Mississippi into a bathtub. It was a moment hackers around the world dream of—a tool that could give them unimaginable power. But maybe it was best simply to close his laptop and forget it. He could pretend he hadn't just stumbled over a skeleton key to the Net. Life would certainly be less complicated. If he stole money, he'd risk prison. If he told the world, he'd be the messenger of doom, potentially triggering a collapse of Web-based commerce."
#bind #dns #flaw #internet #networking #security
archive.org #11721

Why Obama Should Keep His BlackBerry - BusinessWeek

http://www.businessweek.com/the_thread/techbeat/archives/2008/11/why_obama_shoul.html?chan=top+news_top+news+index+-+temp_news+++analysis
"Obama comes into office as the first President both knowledgeable about and comfortable with the technology that runs today's world. This is actually an important and promising development and the worst thing we can do is try to force him into a technology-free cocoon in the name of security or whatever. Mr President-elect, if you want to keep that BlackBerry, please do so. Besides, we don't want a new President going through his difficult first weeks in office suffering from BlackBerry withdrawal."
#blackberry #email #internet #mobile #obama #politics #president #security #technology
archive.org #11676

csrf_protect.php

http://simonwillison.net/static/2008/csrf_protect.php.txt
"This class adds CSRF protection to existing PHP applications that make use of PHP's session support for authentication. If you are writing an application from scratch you shouldn't use this; it's designed to protect legacy apps that were not built with CSRF in mind."
#csrf #php #security #webdev
archive.org #11432

Nostradamus

http://www.win.tue.nl/hashclash/Nostradamus
"We have used a Sony Playstation 3 to correctly predict the outcome of the 2008 US presidential elections. In order not to influence the voters we keep our prediction secret, but commit to it by publishing its cryptographic hash on this website."
#cryptography #hashes #md5 #security
archive.org #10611

The Metasploit Project

http://www.metasploit.com
"This site was created to fill the gaps in the information publicly available on various exploitation techniques and to create a useful resource for exploit developers."
#security
archive.org #3093

WebPwdHash

http://crypto.stanford.edu/PwdHash
"PwdHash is an Internet Explorer plug-in that transparently converts a user's password into a domain-specific password."
#security #webdev
archive.org #3036

Making Votes Count: Gambling on Voting

http://www.nytimes.com/2004/06/13/opinion/13SUN1.html?ei=5007&en=40e4afe91f2a555f&ex=1402459200&partner=USERLAND
"If election officials want to convince voters that electronic voting can be trusted, they should be willing to make it at least as secure as slot machines."
#politics #security
archive.org #2815