April 11
Craig Newmark is throwing 50m into “cyber civil defense” which will be focusing on tools for the common civilian.
Impressive improvement in cracking passwords.
A little dive into the shitty world of Russian disinformation.
Goodbye Tracking? Impact of iOS App Tracking Transparency and Privacy Labels
Overall, our findings suggest that, while tracking individual users is more difficult now, the changes reinforce existing market power of gatekeeper companies with access to large troves of first-party data.
[2204.03556] Goodbye Tracking? Impact of iOS App Tracking Transparency and Privacy Labels
Tracking is a highly privacy-invasive data collection practice that has been ubiquitous in mobile apps for many years due to its role in supporting advertising-based revenue models. In response, Apple introduced two significant changes with iOS 14: App Tracking Transparency (ATT), a mandatory opt-in system for enabling tracking on iOS, and Privacy Nutrition Labels, which disclose what kinds of data each app processes. So far, the impact of these changes on individual privacy and control has not been well understood. This paper addresses this gap by analysing two versions of 1,759 iOS apps from the UK App Store: one version from before iOS 14 and one that has been updated to comply with the new rules. We find that Apple's new policies, as promised, prevent the collection of the Identifier for Advertisers (IDFA), an identifier for cross-app tracking. Smaller data brokers that engage in invasive data practices will now face higher challenges in tracking users - a positive development for privacy. However, the number of tracking libraries has roughly stayed the same in the studied apps. Many apps still collect device information that can be used to track users at a group level (cohort tracking) or identify individuals probabilistically (fingerprinting). We find real-world evidence of apps computing and agreeing on a fingerprinting-derived identifier through the use of server-side code, thereby violating Apple's policies. We find that Apple itself engages in some forms of tracking and exempts invasive data practices like first-party tracking and credit scoring. We also find that the new Privacy Nutrition Labels are sometimes inaccurate and misleading. Overall, our findings suggest that, while tracking individual users is more difficult now, the changes reinforce existing market power of gatekeeper companies with access to large troves of first-party data and motivate a countermovement.
This cyberpunk future is both amazing and terrifying and, frankly, terrible. It’s not exactly the Off World Colonies, but…
Impressive progress in solving security. Looks like UAF memory corruptions will all be over by Christmas!
As we frequently discuss, there is a lot of soft power in having good opportunities and desirable lifestyles. For example, you can brain drain your adversaries.
Russian emigration started to explode in 2012 after Putin began his third term as president.
Some sorta nginx 0day going about. Some initial reports of ITW exploitation and an older version being vulnerable? Is it the same issue as this one?
Additional info is available on GitHub.
GitHub - AgainstTheWest/NginxDay: Nginx 18.1 04/09/22 zero-day repo
Nginx 18.1 04/09/22 zero-day repo. Contribute to AgainstTheWest/NginxDay development by creating an account on GitHub.
And an interview with the person behind the exploit. Or at least part of the team. See next.
A Pro West hacking collective. They find and develop an nginx 0day. And then immediately report it via HackerOne. Just… what kind of hackers are these?
The sections on motivations and where they see themselves in the larger cyber conflict is interesting.
https://www.databreaches.net/an-interview-with-againstthewest/The Awesome OSINT list.
GitHub - jivoi/awesome-osint: :scream: A curated list of amazingly awesome OSINT
:scream: A curated list of amazingly awesome OSINT - GitHub - jivoi/awesome-osint: :scream: A curated list of amazingly awesome OSINT
%
The updates on this eBay listing. It is very funny and the storytelling is incredible
https://www.ebay.co.uk/itm/154933141682A bunch of semgrep rules for vuln hunting.
Semgrep ruleset for C/C++ vulnerability research
