Cybersecurity
Vulnerabilities, exploits, cryptography and defensive engineering — written by people who patch real servers.
$ ls -t ~/cybersecurity
First, allow me to start off with that I am absolutely loving using Passkeys to login into CloudFlare, Stripe, and other important services that I use to run
JavaScript cannot do RSA with numbers. Not slowly, not imprecisely — at all. The largest modulus a Number can handle is 26 bits and RSA needs 2048, and the failure is silent. Here's the implementation that works and why.
Cipher.getInstance("AES") compiles, runs, encrypts, decrypts, and hands you the weakest mode in the box. Here is the OpenJDK source that makes that decision, and the line where ECB gets chosen for you.
Google’s Go programming language has added support for vulnerability management, which project developers said was an initial step toward helping Go developers learn about known vulnerabilities that could impact them. In a blog post on September 6, the Go security team gave an overview of Go’s…
Claire Tills, senior research engineer at Tenable, describes the methods of the hacking group Lapsus$ as bold, illogical and poorly thought out. The criminals attacked renowned companies such as Microsoft, Samsung, Nvidia, Vodafone, Ubisoft and Okta. They stole data and sometimes used ransomware…
GitHub is making available a new IAM (Identity and Access Management) tool, dubbed Entitlements, which leverages the company's own Git framework to parse, track and approve access to a business' systems. The basic idea of Entitlements is to use a dedicated Git repository as a way to provide a…
A CEO bragged he'd unmasked Anonymous. Hours later, a SQL injection in his own CMS ended his career. The real attack chains behind hacktivism, tools included.
The Linux Foundation and the Open Source Security Foundation (OpenSSF) have introduced the Open Source Software Security Mobilization Plan. This is in response to attacks on the software supply chain and an uptick in interest in securing them. Supply chains are appealing targets to malicious…
The hackers– who may have links to cybercrime group Lapsus$ – are said to have compromised accounts to make emergency data requests on people's accounts that are using Apple and Facebook services. Apple and Facebook parent company Meta provided user data to cybercriminals last year who…
In case you haven't read former 2 articles on this topic, below are the links: Side-channel attacks The first 2 articles focused mainly on the idea and implementation of RSA. As such they left out a relevant topic in modern encryption. Side-channel attacks take advantage of data we'd usually…
Please note that it is essential for me to emphasize that the code and techniques presented here are intended solely for educational purposes and should never be employed in real-world applications without careful consideration and expert guidance. At the same time, understanding the principles…
Key generation works, encryption round-trips, the math is provably right — and an attacker can still recover the private key by timing your decryptions. Here are both defenses, measured, with what they actually cost.
$ ssh community@sudosecurity
Ask in the forums, share a snippet, or work through a course on Learn.
