China alleges the NSA mounted a cyberattack on its National Time Service Center (NTSC), the country's official timekeeper. The attack reportedly attempted to compromise high-precision timing. Beijing has not stated if the attempt was successful. (Thread 🧵)

A few researchers from UCSD and UMCP scanned bunch of satellite links, found much of the traffic is not encrypted, and went on to decode them. It's amazing what came out. - T-Mobile backhaul: Users' SMS, voice call contents and internet traffic content in plain text.

OTA update to Jeep Wrangler bricks the vehicle. No attack suspected here. Nonetheless, it exposes an often under appreciated attack vector. It is scary how easy it will be for a motivated actor to cause chaos by just bricking stuff en masse. www.4xeforums.com/threads/wran...

This terrible event is a reminder that "Availability" is a critical goal for security and privacy systems. After all, we are in the risk mitigation business. And losing critical assets is one of the biggest risks a business faces. koreajoongangdaily.joins.com/news/2025-10...

i wrote about atproto and why it matters

Imagine the shitshow we'd be in right now if ICANN hadn't been spun off from the US government

Good news on mobile zero-days in 2024: - Zero day exploits in mobile fell YoY (~50%) - Exploit chains with multiple zero day vulnerabilities are almost exclusively in mobile. Generally, this means mobiles are harder to break in.

My thoughts on why PUF never took off in the SoC world: vinothd.com/blog/3-the-m... tl;dr: PUF does not simplify the secure manufacturing trust model. Not having to generate the root private key is cool. But you cannot do much with it without extracting the corresponding public key.

Xi and Trump could have been born the same day!! I have never been more curious about someone's exact time of birth.

Crazy story of well crafted Honeypot to link ongoing industrial espionage to senior leadership at a competitor Lawsuit Alleges $12 Billion "Unicorn" Deel Cultivated Spy, Orchestrated Long-Running Trade-Secret Theft & Corporate Espionage Against Competitor | Rippling www.rippling.com/blog/lawsuit...

"It's not a backdoor, it is an undocumented entryway in the rear of the building that is hidden from plain view"

Three questions about Apple, Encryption, and the U.K. blog.cryptographyengineering.com/2025/02/23/t...

I gave a day 1 closing keynote at DistrictCon yesterday. Surprisingly, it was a security talk about memory safety. Slides are here: docs.google.com/presentation...

Here's an unintentional demonstration of AI being able to find and use exploits. Sakana AI announced an AI agent that optimized kernels and achieved up to 100x speedup. Turned out the agent cheated with a memory exploit it found in the verification code. sakana.ai/ai-cuda-engi...

Senator Wyden has proposed a bipartisan bill that would block foreign nations from demanding backdoors in US encryption. www.wyden.senate.gov/news/press-r...

$1.4B stolen from cold wallet at Bybit crypto exchange. Initial report implies hackers manipulated the UI for the signing app/device. Signers were thinking they were signing something benign (based on UI), but the actual message that got signed was diff. announcements.bybit.com/en/article/i...

UK laws mandate cookie banners for privacy, but outlaw end to end encryption. apnews.com/article/appl... PS: UK has it's own GDPR called UK GPDR that closely mirrors EU GDPR

Such a simple and ingenious method to isolate reasoning from memorization in LLMs. Performance of reasoning models drop significantly evaluated based on multiple choice questions in which the correct answer was replaced with 'None of the others' arxiv.org/abs/2502.12896

Indian police trained eagles to bring down drones. The eagles use nets to drag the drones down to the ground rather than grabbing them directly. Nets prevent injuries to eagles as well as get the drones to a safe place rather than dropping them wherever they are. www.instagram.com/newsxofficia...

Paper from Google on effectiveness of using LLMs for large-scale code migrations: arxiv.org/abs/2501.06972 A few interesting observations: - >50% savings in the time needed for the task - LLM is only part of the solution. Traditional AST, heuristics, safe deployment infra are also essential.

DOJ/FBI supported by the French law enforcement, removed PlugX malware from ~4K computers by sending a self delete command to the malware in those computers. Owners of those computers will be notified after the fact by their ISP providers that this happened. link: thehackernews.com/2025/01/fbi-...

In my technical writing, I may sling "Band-Aid" as an insult for shoddy fixes, but fear not, #johnsonandjohnson I always capitalize my "Band-Aid"s. Respect the trademark, even when throwing shade. 😉

#Bitcoin community is rooting for soverign ownership,. But they better be careful what they wish for. I predict that govts will stack those sats through seizures, not by open market purchases. Siezures are not a bad thing. BTC economy must be subject to the law of the land.

Court declines Coinbase's demand to order SEC to engage in rulemaking. Also says: SEC's refusal to Coinbase's rulemaking petition is "insufficiently reasoned, thus arbitrary and capricious". Remands to SEC for a proper explanation. www2.ca3.uscourts.gov/opinarch/233... #coinbase #cryptocurrency

For the first time ever, a US Federal agency (CISA) publicly and in plain language, advises folks to use end-to-end encrypted communications apps like Signal. There are other agencies who say end-to-end encryption is not 'responsible encryption'. Don't mind them. You do need it.

"Does this device/feature even need to exist?" is a question I wish we ask more when reviewing vulnerabilities/bugs. A recent reminder: A digital license plate product has been hacked that will allow the user to display any number they want from a smart phone: www.wired.com/story/digita...

Media #DRM and DRM adjacent projects and companies have a bad rap. Some of that reputation may not be totally undeserved. However, credit where credit is due. It may not be a popular opinion. But facts are facts. So here it goes:

“Systems don’t learn because people learn individually –that’s the myth of modernity. Systems learn at the collective level by the mechanism of selection: by eliminating those elements that reduce the fitness of the whole…” — Nassim Nicholas Taleb link.medium.com/mD5MMhUIkPb

Dear every app developer: It is not 2011. I am not sitting at a desktop computer with a CRT clicking links in emails. I am using an app. Please just keep me inside the app. Send me a code by text or email if you must. Don’t make me set passwords. Don’t make me leave your app to use a browser.

Isolation primitives are the penicillin of security. It's a broad spectrum defense against vulnerabilities that you may not even know exist.

I'm thankful for the top 10 inventions that make modern life possible: - Mass producible integrated circuits - Binary number system

This is also a great and comprehensive guide for evaluating your own threat model and taking steps to protect yourself.

John Oliver's take on TikTok and the TikTok ban is really, really good www.youtube.com/watch?v=5CZN...