IT Hello
search

Sections

Cyber Security

3712 articles

HTTPS certificate industry phasing out less secure domain validation methods
cybersecurity

HTTPS certificate industry phasing out less secure domain validation methods

The Chrome Root Program and the CA/Browser Forum are enhancing internet security by updating HTTPS certificate issuance practices. They are phasing out 11 outdated Domain Control Validation methods, which relied on weaker verification signals like emails and phone calls, by March 2028. This initiative, part of the “Moving Forward, Together” roadmap, promotes modern, automated validation methods that offer stronger protection against fraudulent certificates. These changes aim to create a safer browsing experience for all users.

Google Online Security Blog ·
The Fragile Lock: Novel Bypasses For SAML Authentication
cybersecurity

The Fragile Lock: Novel Bypasses For SAML Authentication

TLDR This post shows how to achieve a full authentication bypass in the Ruby and PHP SAML ecosystem by exploiting several parser-level inconsistencies: including attribute pollution, namespace confusi

PortSwigger Research ·
cybersecurity

Chainguard: Unchained ·
Further Hardening Android GPUs
cybersecurity

Further Hardening Android GPUs

Google’s Android Red Team, in collaboration with Arm, conducted a security analysis of the Mali GPU, crucial for billions of Android devices. They identified vulnerabilities primarily in how User-Mode Driver and Kernel-Mode Driver interact, leading to potential exploits. The analysis focused on reducing the attack surface by restricting access to certain GPU IOCTLs through a staged SELinux policy rollout. This effort aims to enhance GPU security, ensuring resilience against threats while providing guidelines for device-specific implementations. The initiative highlights the importance of proactive security measures in safeguarding against existing and future vulnerabilities in Android systems.

Google Online Security Blog ·
Architecting Security for Agentic Capabilities in Chrome
cybersecurity

Architecting Security for Agentic Capabilities in Chrome

Nathan Parker from the Chrome security team outlines the advancements made in browser security due to the introduction of agentic capabilities in Chrome, particularly concerning the risks of indirect prompt injection. To address these threats, Google has developed a layered defense strategy that includes features like the User Alignment Critic, which reviews actions for user alignment and protects against goal-hijacking. Enhanced origin isolation limits the data agents can access, while user confirmations ensure control over critical actions. Continuous monitoring and collaboration with the security community are emphasized as essential to maintaining safety amid evolving challenges.

Google Online Security Blog ·