Parse notes
Sponsored
Fortune 50 companies like AWS and Google and fast growing startups like Vercel and Secureframe work with TLDR to reach our audience of over 4 million tech-savvy decision makers with highly customized campaigns (like this one!). If you know a marketer who could benefit from running a campaign with us, I'd appreciate it if you sent them our advertising page [4]! Thanks!
Researchers have discovered a side-channel vulnerability in the Apple M-series chips. This vulnerability allows attackers to extract secret encryption keys during common cryptographic operations. The flaw is inherent to the chip design and cannot be patched with software updates.
Fujitsu has reported that its internal systems were breached. An internal investigation revealed that customers’ personal information may have been accessed and exfiltrated. At this time, Fujitsu has not reported any illicit use of the stolen data.
VF Group - which owns brands such as Vans, The North Face, and Timberland - reported that it suffered a data breach in December 2023. Stolen information included email addresses, full names, phone numbers, and billing and shipping addresses. The company maintains that no financial information could have been stolen as it doesn't collect or retain any.
A group of researchers discovered a method to bypass AWS’ Block Public Access protections in a way that will not be detected by AWS. The method requires using a Customer Managed KMS key and a permissive bucket policy.
This post discusses utilizing Visual Studio Code extensions as a persistence mechanism. It begins with an overview of the process of creating extensions for VS Code and then walks through the process of developing a malicious extension that utilizes activation events to install a malicious implant.
This post describes a project, inspired by linux_injector, for injecting code into a process on Android without the use of ptrace. The injector locates a function in /proc/mem to overwrite and then utilizes a multistage shell code injector to map memory and inject to it. The post goes through the process of developing the shell code and the injector in Rust.
bincapz is a tool to enumerate a list of predicted capabilities of a binary. It can be run in diff mode to catch any supply chain vulnerability.
AutoSmuggle is a tool that creates HTML or SVG files that can be smuggled past content filters.
ReverserAI provides automated reverse engineering assistance through the usage of LLMs. The LLMs are locally hosted and can be run on consumer-grade hardware.
This article provides an overview of the APFS file system. It begins by describing the data structures that make up a file in APFS, then describes the clone operation that allows for efficient file duplication and how hard links work. The post concludes by describing how to use the author’s tool to inspect APFS file attributes.
The House has passed a landmark data privacy bill. The bill prevents any company that is defined as a data broker from selling data to foreign adversaries. It now moves to the Senate along with the TikTok ban. The bill faces much wider bipartisan support.
GitHub has launched a beta for its code-scanning autofix feature. This feature combines CodeQL and Copilot to suggest fixes for detected vulnerabilities. GitHub promises that the feature can remediate two-thirds of vulnerabilities it finds with 90% coverage of its supported languages.
The U.S. is reportedly considering blacklisting the Chinese chipmakers that are responsible for making Huawei’s chips.
Glassdoor has announced a new policy that requires posters to verify their real names.
Hackers at Pwn2Own Vancouver 2024 earned $1,132,500 by demonstrating 29 zero-day vulnerabilities across various categories like web browsers, enterprise applications, and more.