ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “generalization”

44 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 1938Ransomware 1910Policy & legal 1830Malware 1476Industry 1307Data breach 1301Exploit / PoC 1094Threat actor 1004Phishing & fraud 788AI tools & infra 217Research 208AI research 174AI safety & security 167AI industry 146
SeverityAllcritical 5001high 3262medium 1927low 2834info 827

TLD Tracker: Exploring Newly Released Top

Unit 42 tracked 19 newly released top-level domains and found large-scale phishing, unwanted program distribution, and cybersquatting tied to TLD launch dates.

Researchers analyzed 19 new generic TLDs, including .zip, .bot, .ing, and .meme, released or approaching general availability over roughly 18 months. Data from passive DNS, registry zone files, newly registered domain feeds, and the Tranco top-1M list showed phishing campaigns, potentially unwanted program distribution, and domain squatting on these TLDs. Abuse correlated with each TLD's rollout phases, indicating attackers monitor general availability dates to register and weaponize domains. The IANA root database now lists over 1,000 generic TLDs.

Palo Alto Unit 42 · Aug 17, 2026Research

Linux Detection Engineering - Local Privilege Escalation

Elastic details a layered detection framework for Linux local privilege escalation, covering 2026's copy-on-write bug wave and LLM-assisted discovery.

Elastic Security Labs describes how most Linux local privilege escalations share a common host flow — an unprivileged process launched from a writable path becoming root — and proposes layered detections combining general outcome-based rules with per-technique rules in Elastic Defend and Auditd. It tracks 13 recent LPE disclosures, seven of which share a copy-on-write/zero-copy bug class, including Copy Fail, DirtyFrag, Fragnesia, DirtyDecrypt, DirtyClone, pedit COW, and RefluXFS. Qualys attributes RefluXFS to an LLM-assisted research effort with Anthropic using Claude Mythos Preview, and another bug is credited to an LLM-assisted workflow. Detection and endpoint rules are published in Elastic's detection-rules and protections-artifacts repositories.

Elastic Security Labs · 6d agoResearch1

Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0 (1999)

Seminal 1999 USENIX study finds most novice users cannot correctly sign and encrypt email with PGP 5.0 in 90 minutes.

Whitten and Tygar's USENIX Security Symposium paper evaluates whether cryptography novices can use PGP 5.0 effectively, using cognitive walkthrough analysis and a laboratory user test. The majority of test participants failed to successfully sign and encrypt a message within 90 minutes, despite PGP 5.0 having a well-regarded graphical interface. The authors argue that security requires usability standards beyond those of general consumer software and propose domain-specific UI design principles for security. The paper is a foundational reference in usable security research.

Lobsters · security · 8d agoResearch

MarkSec: Capability-Aware Evaluation of Adversarial Attacks Against LLM Watermarks

MarkSec unifies evaluation of stealing, scrubbing, and spoofing attacks against LLM watermarks with quality-constrained success metrics under shared reporting protocols.

MarkSec is a framework unifying analysis of stealing, scrubbing, and spoofing attacks against LLM watermarks under shared detector calibration, metric definitions, and reporting protocols. It introduces a quality-constrained attack success metric that jointly assesses attack effectiveness and text quality. Experiments across representative watermark families, attacks, LLMs, and datasets show that attacks strongest by watermark removal alone can fall behind general rewriting when success requires acceptable text quality, and stealing-based scrubbers often underperform the best general-scrubbing baselines.

arXiv cs.CR · 2d agoResearch

Private Information Retrieval With Arbitrary Privacy Requirements: Introduction and Capacity Results

Researchers formulate private information retrieval under arbitrary graph-based privacy requirements, deriving capacity bounds and introducing pyramid storage graphs.

The paper generalizes classical private information retrieval (PIR) to arbitrary privacy requirements over graph-based storage systems, where each message is retrieved privately from a pre-specified server subset. The authors derive lower and upper capacity bounds for general graphs and exact capacity results for path and cyclic storage graphs. They also introduce a new pyramid storage graph structure that models symmetric message storage and replication patterns.

arXiv cs.CR · 2d agoResearch

Introducing Unit 42’s Attribution Framework

Unit 42 releases its Attribution Framework, a systematic method using Diamond Model and Admiralty scores to attribute activity clusters to named threat actors.

Palo Alto Networks' Unit 42 introduced a structured framework for threat actor attribution built on the Diamond Model of Intrusion Analysis and Admiralty reliability/credibility scoring. The framework tracks activity at three levels: activity clusters (named CL-STA, CL-CRI, CL-UNK, or CL-MIX), temporary threat groups, and named threat actors using the constellation naming schema. Analysts score evidence across TTPs, tooling, malware code, OPSEC, infrastructure, timelines, and victimology to decide when to merge or elevate clusters, avoiding premature group naming.

Palo Alto Unit 42 · Aug 17, 2026Research

AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key

Huntress research shows AD RMS SLC root key is unrotatable and never expires, so its compromise permanently exposes all RMS-protected documents.

Part 2 of Huntress's AD RMS series details server-side attacks: extracting the Server Licensor Certificate (SLC) private key and performing offline decryption of protected documents. The SLC key has no expiry or rotation mechanism, with a 255-year certificate validity (2002–2258), so whoever recovers it can decrypt every document the deployment ever protected, indefinitely. The author released SharpRMS, a unified tool combining the 2016 DisARMS client-side attacks with new server-side key extraction and decryption capabilities. The research frames the SLC as comparable to KRBTGT and the DPAPI domain backup key, though not equivalent to domain compromise.

Huntress · 7d agoResearch

Analog Pin Directionality as an Exfiltration Attack Surface in Mixed-Signal ICs

Researchers demonstrate exfiltration through nominally input-only analog pins in mixed-signal ICs, recovering data at 10 kbps on a 55nm PPG front-end.

The paper identifies a directionality-based attack class in analog/mixed-signal (AMS) ICs where data-dependent circuit-offset modulation converts a nominally input-only pin into an outbound information channel. Three host conditions enable the attack: a closed-loop amplifier, an exposed amplifier input, and sufficiently high impedance at that pin. Silicon validation on a photoplethysmography analog front-end in 55nm CMOS showed exfiltration at up to 10 kbps with error-free PRBS recovery, under 0.001% area overhead, and only 0.03 dB SNR reduction.

arXiv cs.CR · 13h agoResearch

Hamming Ideals and Grobner Bases for ISD-like Syndrome Decoding

Researchers combine Grobner bases with Information Set Decoding for syndrome decoding, testing feasibility against Classic McEliece NIST Category 1 parameters.

The paper proposes GBDecode, an ISD-like decoding algorithm that fixes only a subset of an information set and solves the resulting multivariate nonlinear systems via MultiSolve, which replaces one Grobner basis computation with many computations on simpler systems. Hamming weight constraints are reformulated using elementary symmetric functions and Lucas' identity factorizations to bound equation degree. Experiments on random binary linear codes use parameters matching the NIST Security Category 1 set of the Classic McEliece cryptosystem, assessing practical feasibility rather than breaking the scheme.

arXiv cs.CR · 15h agoResearch

A Global Readiness and Sovereignty Capability Model for Post-Quantum Cryptography Migration

Researchers propose a Readiness-Sovereignty Capability Model scoring 57 countries on post-quantum cryptography readiness and sovereignty.

The RSCM model decomposes cryptographic sovereignty into indigenous capacity, indigenous post-quantum control, and external dependency, with a gate requiring demonstrated creation in at least one core layer. Applied to 57 documented cryptographic actors, 20 countries clear the maker gate (15 full-stack, 5 research makers), 11 hold strong general capacity without post-quantum control, and 25 are dependent. Readiness correlates with independent cyber indices up to rank correlation 0.70, while post-quantum creation shows no significant correlation with commitment (0.22).

arXiv cs.CR · 19h agoResearch

The modern attack chain: Rethinking Google Workspace security in the age of AI

Analysis of Vercel and Composio breaches shows stolen OAuth tokens, not phishing email, now open Google Workspace attacks — a path authorized AI agents follow.

The author analyzes the Vercel and Composio breaches as the same OAuth-first attack chain run twice: a stolen OAuth token, obtained via a compromised supplier, becomes the entry point rather than email. These tokens survive password resets, are hard to observe, and let attackers read Gmail and Drive data, take over accounts, and pivot laterally using stored credentials and password-reset magic links. The piece warns that authorized AI agents with overbroad OAuth grants can unintentionally traverse the same path — accessing inboxes, reading sensitive content, and exfiltrating data downstream — without any malicious actor or compromised credential.

Help Net Security · 1d agoResearch in the wild

Apple Reference Image: A New Approach for Verified Photography

Apple introduces Reference Image, hardware-backed verifiable photography on iPhone 18 Pro using sensor signing and Private Cloud Compute to counter AI-generated fakes.

Apple announced Reference Image, an opt-in camera mode debuting on the main sensor of iPhone 18 Pro and iPhone 18 Pro Max that produces securely timestamped, verifiable photographs. The design splits into two phases: a secure digital negative created by cryptographically signing pixel data at the sensor immediately after capture (preventing injection or tampering), then developing that negative into a reference image. Private Cloud Compute handles processing without exposing image contents to anyone, including Apple, and fraudulent reference images can be revoked without revealing the photographer's identity. Apple positions the system as stronger than C2PA-based approaches, which sign metadata after capture, are vulnerable to editing-chain compromise, and can tie images to a device or individual.

Hacker News · security · 1d agoResearchHN 25↑ · 18 comments

Mapping out your unknown: A threat hunter’s guide to GitHub

Datadog Security Labs publishes a threat-hunting guide with audit-log queries to detect GitHub token theft, device code phishing, and source code exfiltration.

Datadog's threat-hunting guide covers GitHub audit log queries for detecting compromised accounts, stolen personal access tokens, and malicious OAuth app authorizations. Attackers typically obtain credentials through phishing, credential stuffing, leaked secrets, or device code phishing, then map private repositories, exfiltrate source code, and pivot into connected cloud and CI/CD environments. The guide maps detections to MITRE techniques like T1078 and T1528 and documents GitHub logging quirks affecting attribution, token metadata, and visibility fields.

Datadog Security Labs · 1d agoResearch in the wild1

1Password's AI patching benchmark is misleading

Trail of Bits reanalysis says 1Password's 26% AI clean-fix rate is misleading; 86% of eligible patches blocked exploits.

Trail of Bits critiques 1Password's FLAWED AI patching benchmark, arguing its 26% clean-fix headline mixes trials where agents were instructed to apply wrong fixes (22% of data) with trials that prohibited compiling or testing (36%). Restricting to reasonable conditions, 2,634 of 3,067 patches (86%) blocked the supplied exploit. Trail of Bits also reports 12.5% of 2,265 developer first fixes failed in its own 2024-2026 assessments, and released post-patch-validation and review-walkthrough agent skills.

Lobsters · security · 1d agoResearch1

No Bit Left Behind: Using Brute-Force Lifting to Achieve Fully Static Binary Recompilation

Prototype binary lifter brute-force lifts every byte offset of x86-64 binaries to LLVM IR, enabling fully static cross-ISA recompilation without runtime support.

The paper presents a fully static, whole-program binary lifting system that treats every byte offset as a potential branch target, constructing a superset control flow graph that conservatively contains all feasible control flows. Statically unresolvable computed branches are reduced to lookups in a dispatch table pointing to translated control flow paths, eliminating runtime translation machinery on the target machine. A prototype recompiles x86-64 binaries to LLVM IR with no code/data heuristics and achieves fully static cross-compilation to AArch64 using unmodified LLVM backends.

arXiv cs.CR · 2d agoResearch1

The Model Proposes, the Code Disposes: A Pre-Registered Ablation of a Verifier-and-Acceptance Stage in an LLM-Orchestrated Offensive-Security Agent

Pre-registered ablation finds a model verifier stage in an LLM offensive-security agent suppresses findings; removing it eliminated suppression with precision tradeoff.

The paper evaluates a verifier-and-acceptance stage in an LLM-orchestrated offensive-security agent via a pre-registered 20-run confirmatory ablation and a 2x2 factorial study with 40 runs on vulnerable lab targets. Removing the stage eliminated pre-report suppression (median 2 vs 0 findings, p = 0.00003) but reduced model-blinded shipped precision (0.471 vs 0.353, p = 0.0087). Suppression was attributed to the model verifier rather than deterministic acceptance rules, and an instrumented canary recorded zero external contacts in all 60 runs. The full design retained 93.8% of model-adjudicated true candidates but failed its pre-registered non-inferiority floor of 0.90.

arXiv cs.CR · 2d agoResearch

How Attackers Abuse VSS, and How Huntress Detects It

Huntress details how attackers abuse Windows Volume Shadow Copies for ransomware recovery sabotage and NTDS.dit credential theft, plus detection logic.

Huntress explains that attackers abuse VSS in three ways: deleting shadow copies to inhibit recovery before ransomware detonation, creating shadow copies to extract the NTDS.dit Active Directory database for offline credential theft, and manipulating shadow copy configuration. Because backup agents and RMM tools routinely create and delete shadow copies, raw events are too noisy to alert on alone. Huntress detections instead correlate VSS activity with lateral movement and credential harvesting over a time window, such as an observed sequence of PsExec spawning SYSTEM shells on a domain controller, vssadmin create shadow, a blocked deletion attempt, and DNS reconnaissance against another host.

Huntress · 2d agoResearch

Large Universe Subset Predicate Encryption with IND-CCA Security (with Constant-size Ciphertext and Keys)

New construction achieves first large-universe subset predicate encryption with IND-CCA security and constant-size ciphertexts and keys under subgroup decision assumptions.

The paper proposes the first large-universe subset predicate encryption scheme achieving IND-CCA security with both constant-size ciphertexts and constant-size secret keys. Prior large-universe constructions by Chatterjee and Mukherjee either achieved only restricted selective security with constant sizes or adaptive security with attribute-dependent ciphertext size, and none achieved CCA security. The new construction is proven selectively secure under standard subgroup decision problems. Black-box transformations yield the first CCA-secure WIBE and WKD-IBE with constant-size ciphertexts and keys.

arXiv cs.CR · 2d agoResearch

Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection

Unit 42 clusters behavior of 40,000+ AWS identities from 125 cloud environments to map functional roles and enable lightweight SQL-based detection.

Palo Alto Unit 42 built an unsupervised behavioral clustering model using UMAP and HDBSCAN on AWS CloudTrail logs to map cloud identities to functional roles such as administrators, backup services, security tooling and DevOps. The study analyzed over 40,000 identities across 125 cloud environments over two months. The researchers show that heuristics extracted from the clustering map can be implemented in standard SQL, enabling role classification at scale without running a continuous ML pipeline. The methodology extends to audit logs from other cloud providers, SaaS and Kubernetes.

Palo Alto Unit 42 · 2d agoResearch

Sociotechnical Aspects of Tor Relay Rejection

User study and simulations of Tor's relay end-of-life rejection policy find operators favor it; network churn affects anonymity more than EoL exclusions.

The study examines the Tor Project's 2019 end-of-life policy that rejects outdated relays, which constitute a notable fraction of consensus weight. A user study of 26 relay operators found they generally view the policy favorably despite limited awareness, though operational practices occasionally exclude newly installed relays. Historical-data-driven simulations show the policy gives adversaries only marginal advantage, with network churn exerting a more pronounced effect on user anonymity. Analysis of four exclusion rounds shows a minority of rejected relays typically account for over 50% of the security provided by all excluded relays, informing EoL policy recommendations.

arXiv cs.CR · 2d agoResearch

Turn it off and on again, but for critical infrastructure

KTH researchers trained a reinforcement-learning intrusion response agent on an emulated segmented OT network that autonomously resets hosts and processes to disrupt intruders.

Researchers at KTH Royal Institute of Technology built a containerized replica of a segmented industrial network, attacked it across 14 days, and captured 40,000 30-second traffic intervals to train a defense agent under partial observability. The agent observes six packet-count numbers per interval, maintains 500 running state hypotheses, and can reset supervisory hosts, water tank processes, or entire subnets, with resets rebooting the target, renewing credentials, and changing its IP. The best agent approached a full-visibility baseline but depends on an assumed attacker behavior model; the testbed comprised three supervisory hosts, two PLCs, two tanks, weak credentials, and CVE-2017-7494 exposure. The team released its implementation and plans validation on a real industrial testbed with a partner.

Help Net Security · 3d agoResearchCVE-2017-74942· 1 read

Efficient Branch-and-Bound Testing and Verification of zkVMs

ZEBRA verifies zkVM constraint systems via branch-and-bound cardinality counting, finding 11 zero-day bugs across five real-world zkVMs and running 51.5x faster than SMT verification.

ZEBRA reduces zkVM correctness to a solution-set cardinality problem requiring that each constraint system admit exactly one valid execution trace, eliminating redundancies like null-row padding and non-deterministic permutations before counting. It lifts analysis from finite-field witnesses to an integer interval lattice, exploiting that constraints across 5 real-world zkVMs use only 14.0% of theoretical connectivity capacity on average, enabling tight interval propagation. A parallel branch-and-bound search produces concrete counterexamples or certifies absence of violations within a bounded region. ZEBRA discovers 11 zero-day bugs (6 independently confirmed, 3 fixed), is 51.5x faster than SMT-based verification, and verifies 16.5 percentage points more instances.

arXiv cs.CR · 3d agoResearch

Phishing Research Challenges Conventional Security Awareness Testing

Pistachio's 2.47 million phishing simulations across 1,200 organizations show click rates alone mislead, with 30% of IT staff clicking and leak rates more predictive.

Between June 2025 and May 2026, Pistachio sent 2.47 million simulated phishing attempts to more than 123,000 employees at over 1,200 organizations, analyzing click, credential-leak and reporting behavior. Click rates ranged from 26% in Design to 41% in Construction; 30% of tech development and IT staff clicked at least once, while financial services were the most resilient sector. The report argues that click rate alone creates a false sense of security and that combined click, leak and report trends are better resilience indicators.

SecurityWeek · 5d agoResearch

Differential Privacy Meets Fixed Parameter Tractability: Algorithms and Lower Bounds

Theory paper combines differential privacy with fixed-parameter tractable encoders, improving approximation guarantees for combinatorial optimization and proving new lower bounds.

The paper studies combinatorial optimization under epsilon-differential privacy within the implicit encoder-decoder framework of Gupta et al. (SODA 2010), generalizing it to allow fixed-parameter tractable encoders. This circumvents approximation barriers inherent to polynomial-time algorithms and yields improved guarantees for fundamental combinatorial optimization problems. The authors establish the first representation-independent lower bounds: assuming a non-uniform variant of the Gap Exponential Time Hypothesis, no epsilon-DP encoder-decoder pair can achieve certain approximation guarantees with a subexponential-time decoder for sufficiently small epsilon. Representation-dependent lower bounds are also provided for larger epsilon.

arXiv cs.CR · 5d agoResearch

Heterogeneous Cross-Chain Transaction Tracing for Solana Bridges via Candidate-Set Selective Decision

SolTracer traces cross-chain transactions onto Solana bridges, improving open-world association F1 by 20.16% over the strongest baseline for illicit-fund tracing.

The paper formalizes four Solana-bound cross-chain transaction modes and proposes SolTracer, which maps heterogeneous execution semantics into a unified event space and uses candidate-set selective decision-making with abstention when valid targets are absent. In the challenging open-world setting with a 50% TA ratio, SolTracer improves F1 by 20.16% over the strongest baseline. An empirical study of real-world transfers examines count-value divergence across bridge mechanisms, cross-asset shifts, and decoupling between on-chain settlement and explorer visibility.

arXiv cs.CR · 6d agoResearch

CertiFlash: A Formal Verification Framework for Flash Translation Layers in Computational Solid State Drives

CertiFlash provides machine-checked formal verification of SSD flash translation layers, proving isolation, integrity, and ownership invariants to prevent tenant data leaks.

CertiFlash is an open-source formal verification framework for Flash Translation Layers (FTL) in computational SSDs, mechanized in the Rocq proof assistant. It shows that a faulty FTL can corrupt device state at five surfaces (e.g., leaking data between tenants or dropping integrity tags), demonstrated on a DaisyPlus OpenSSD. Designers prove once that every operation of a general FTL model preserves a global invariant covering mapping, isolation, integrity, ownership, and allocation; new designs need only discharge five hypotheses. Across four case studies, added effort was 27-3,231 lines against a 16,489-line framework.

arXiv cs.CR · 7d agoResearch1

Proximity Gaps for Gabidulin Codes and Applications

Researchers prove proximity-gap bounds for rank-metric and Gabidulin codes, enabling the first polynomial commitment scheme framework based on rank-metric error-correcting codes.

The paper proves every linear rank-metric code admits a proximity gap for deltas up to (d-1)/(3n) with error at most q^(e+1)/q^m, and improves the gap to (d-1)/(2n) for Gabidulin codes with error at most 10q^(n-1)/q^m, matching bounds for Reed-Solomon codes. A constructed infinite family of constant-rate Gabidulin codes shows the (d-1)/(2n) bound is tight, and a counterexample establishes a lower bound on the error at the d/(3n) gap. Applications include an IOPP for interleaved Gabidulin codes adapted from the Ligero IOPP and a q-linearized polynomial commitment scheme adapted from Ligero-based PCS, reportedly the first PCS framework based on rank-metric codes.

arXiv cs.CR · 7d agoResearch

Scalable Composition of Byzantine Agreements under Reorder Attacks

Researchers present the first adversary model combining party corruption with channel reordering attacks, establishing tight security thresholds for composed Byzantine agreement protocols.

The paper presents the first adversary model combining party corruption with adversarial channel attacks that reorder messages across multiple Byzantine agreement executions. It proves impossibility results for authenticated BA under parallel composition when n ≤ 3t or n ≤ 2c + 2t + 1, with matching possibility results when n > max{3t, 2c + 2t + 1}. The authors provide general black-box compilers plus erasure-correcting-code variants that achieve constant multiplicative communication overhead for long messages.

arXiv cs.CR · 8d agoResearch

On APN Functions with Boomerang Uniformity One over $\mathbb F_{3^n}$: Differential and Boomerang Spectra and CCZ-Inequivalence

Cryptographic construction yields infinite APN function families with boomerang uniformity one over odd-characteristic fields, proving CCZ-inequivalence to power functions.

For q=3^n with odd n>1, every sign-switch of a perfect nonlinear Dembowski-Ostrom polynomial is proven APN with boomerang uniformity one or two, attaining uniformity one for (q-3)/2 parameters. This gives the first general construction of infinite APN families achieving boomerang uniformity one over odd-characteristic finite fields. The authors determine common differential and complete boomerang spectra, ruling out CCZ equivalence with power and Ness-Helleseth binomials, and exhibit three pairwise CCZ-inequivalent PN functions for infinitely many n, with the smallest degree n=45.

arXiv cs.CR · 8d agoResearch

"Shut Up and Let Me Enjoy My Otome": Understanding and Measuring the Toxicity in Otome Game Communities

First large-scale study finds 22.20% of Weibo otome game posts toxic versus 3.71% on Reddit, with LLM detectors reaching 0.82 F1.

Researchers present the first large-scale measurement of toxicity in otome game communities, introducing OtomeSCAN, which collected and analyzed 620,045 posts from Weibo and Reddit over 18 months. They manually annotated 4,308 posts, identified eight target groups, and evaluated seven toxicity detectors, with their best LLM-based model reaching F1-scores of 0.82 on Weibo and 0.78 on Reddit. The study found 22.20% of Weibo posts were toxic versus 3.71% on Reddit, and toxicity rose to 37.09% within 72 hours during an external attack on Weibo. The authors also flagged 191 potential-coordination clusters, 64.40% of which targeted game developers.

arXiv cs.CR · 9d agoResearch

Has anybody seen my keys? A key-hierarchy strategy for rack-level security

Oxide's RFD 0301 proposes a rack-level key hierarchy using Shamir secret sharing and a trust quorum to protect data-at-rest keys.

Oxide's request for discussion (RFD 0301) lays out a key-hierarchy strategy for rack-level security, deriving keys from a rack secret protected by Shamir secret sharing across a trust quorum of sleds, with keys exchanged over authenticated sprockets sessions. The document maps which keys protect control-plane data, metrics, Crucible extents, and authentication tokens, and defines open questions on key lifecycle, locality, and compromise handling. Future work includes sealing shares with the root of trust so an attacker would need to steal K whole sleds to reconstruct the rack secret.

Hacker News · security · 10d agoResearchHN 52↑ · 3 comments

Has MIMO decoding been proved hard from lattice problems?

Researchers show the published lattice-hardness proof for MIMO decoding fails, as Regev's LWE reduction structure does not carry over to non-modular MIMO.

The paper re-examines Dean and Goldsmith's proposed polynomial-time reduction from lattice problems to MIMO decoding, which adapted Regev's reduction for learning with errors (LWE). Prior works had presented attacks and counterexamples against the construction, leaving the reduction's precise validity unclear. The authors identify which structural features of the LWE reduction fail to transfer to the non-modular MIMO setting, showing the published proof does not establish the claimed hardness of MIMO decoding. They distinguish flaws in the hardness proof from direct attacks on specific parameter choices and do not rule out physical layer security for MIMO systems in general.

arXiv cs.CR · 12d agoResearch

Optimizing Credential Blast Radius Through Trust Boundaries and Delegation Under Post-Quantum Authentication Costs

Academic paper models credential blast radius optimization across trust domains under post-quantum latency costs, cutting expected impact by up to 36%.

The paper formulates the joint selection of trust domains and credential-derivation structures under policy and latency constraints as an NP-hard optimization problem, showing the scalarized two-domain direct-issuance case reduces to a weighted minimum cut. In 195 of 230 exhaustive synthetic comparisons, joint optimization produced lower credential blast radius than choosing boundaries first, especially under chained delegation. A trace-derived replay using measured post-quantum authentication costs found the best design reduced expected impact by up to 36% relative to a single domain within the latency budget.

arXiv cs.CR · 13d agoResearch

An Empirical Analysis of CodeQL False Positives and Query Refinements for Java Vulnerabilities

Study of 167 Java CVE instances finds CodeQL false positives follow recurring patterns; query refinements remove 81.8% of reviewed ones.

Researchers ran CodeQL's Java security query suite on 167 CVE instances from 110 projects, manually reviewing 500 sampled false-positive paths and building a five-category taxonomy led by Missed Path Constraint or Sanitization (36.6%), Benign Execution Context (29.4%), and Missing Trust Boundary Modeling (27.6%). Guided by the taxonomy, query-level refinements removed 81.8% of reviewed false positives and 15.8% of reported paths across the selected queries while retaining 7 of 8 true positives. To address generalization, agentic coding tools given the refinement patterns as templates adapted them to new projects successfully in 56% and 62% of tasks, versus 28% without guidance.

arXiv cs.CR · 13d agoResearch1

Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

SpecterOps released CDP-Enable-BOF, a Beacon Object File that enables Chrome DevTools Protocol in live Chrome or Edge processes on Windows for session hijacking.

SpecterOps released CDP-Enable-BOF, an x64 Beacon Object File that activates Chrome DevTools Protocol inside running chrome.exe or msedge.exe processes on Windows, exposing cookies, history, saved passwords, and authenticated sessions without administrator rights. It calls Chromium's StartRemoteDebuggingServer on the browser UI thread to stay reliable under CFG, TLS, and CET, and was tested on Chrome 147 and Edge 147. The technique builds on work by DeathFlamingo and Cedric Van Bockhaven; Google had hardened remote debugging in Chrome 136 after attackers used it to steal cookies post-App-Bound Encryption. Defenders can watch Sysmon Event IDs 8 and 10 for injection into browser processes.

The Hacker News · 22d agoResearch2

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business News · 27d agoResearch2

Risks in IoT Supply Chain

Unit 42 analyzes multilayer IoT supply chain risks across hardware, firmware, and software, citing counterfeit Cisco switches and OpenWrt attacks.

Unit 42 examines weaknesses in the IoT supply chain ecosystem across hardware, firmware, operation, and vulnerability layers, noting that 89% of IT decision-makers reported IoT device growth and IDC forecast 41.6 billion connected IoT devices by 2025. Examples include counterfeit Cisco Catalyst 2960-X switches with possible backdoor access (F-Secure, July 2020), a March 2020 OpenWrt flaw enabling malicious update impersonation, and threat actor interest in TeamViewer remote support software. The report stresses that untracked third-party components and missing device inventories make it hard to assess vulnerability impact across vendors.

Palo Alto Unit 42 · 28d agoResearch

The Year in Web Threats: Web Skimmers Take Advantage of Cloud Hosting and More

Unit 42 analyzed 2.24 million web threat incidents, finding web skimmers increasingly hosted on cloud infrastructure to steal payment card data.

Palo Alto Unit 42 analyzed 2,241,354 web threat incidents and 831,550 unique URLs detected via Advanced URL Filtering between October 2020 and September 2021. Threat activity peaked from October 2020 to January 2021, coinciding with the holiday shopping season, with most malicious domains geolocated to the United States, Russia, and Germany. Web skimmers ranked third among the top five threat classes and showed the most code diversity, making detection harder. Researchers observed more web skimmer families being hosted on cloud platforms to steal payment data and PII.

Palo Alto Unit 42 · Aug 17, 2026Research

Trends in Web Threats: Attackers Were More Active During Holiday Season

Unit 42 tracked 533,000 malicious landing URL incidents from October-December 2021, showing web threats peaked during the holiday shopping season.

Unit 42 detected 533,452 malicious landing URL incidents (120,753 unique) and 2,906,875 malicious host URL incidents (165,255 unique) from October through December 2021. Threat activity peaked in November, likely tied to Black Friday in the United States, United Kingdom, and Germany. Most malicious domains appeared to originate in the United States, followed by Russia and Germany. Personal sites, blogs, business sites, and shopping sites were the most common apparently benign entry points for attacks.

Palo Alto Unit 42 · Aug 17, 2026Research

Trends in Web Threats in CY Q2 2022: Malicious JavaScript Downloaders Are Evolving

Unit 42 detected 751,000 landing URL incidents in Q2 2022 and documented malicious JavaScript downloaders evolving to evade detection.

Unit 42 detected 751,331 landing URL incidents (253,644 unique) and 1,744,629 malicious host URL incidents (256,844 unique) from April through June 2022. Total landing URL incidents rose compared with Q1 2022, and unique host URL incidents grew 42%, indicating attackers deploying more variants. The report includes a case study of a JavaScript downloader campaign demonstrating new evasion techniques. Personal sites, blogs, and business sites were the top apparently benign entry points.

Palo Alto Unit 42 · Aug 17, 2026Research