476
Privacy
50695 readers
786 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 6 years ago
MODERATORS
477
125
A Security Researcher Decompiled The White House App, & What They Found Is Pretty Alarming
(www.androidheadlines.com)
478
479
480
481
482
483
484
485
486
487
209
Facial recognition data is a key to your identity – if stolen, you can’t just change the locks
(theconversation.com)
488
CVE-2026-31431 ("Copy Fail") Meets Iran's Digital Blackout: A Match Made in Hell
While the world scrambles to patch one of the cleanest local privilege escalation bugs in recent memory, a large chunk of Iran's critical infrastructure is sitting there beautifully vulnerable — thanks to the regime's own "protective" internet blackout. The Technical Beauty of Copy Fail
CVE-2026-31431 is a high-severity (CVSS 7.8) logic flaw in the Linux kernel's cryptographic subsystem, specifically the algif_aead module and the authencesn template. It was introduced in 2017 with a performance optimization that accidentally allowed page cache pages (normally read-only for users) to end up in a writable destination scatterlist.
The primitive is terrifyingly simple:
An unprivileged local user opens an AF_ALG socket.
Binds it to authencesn(hmac(sha256),cbc(aes)).
Uses splice() in a clever way.
Achieves a controlled 4-byte write into the page cache of any readable file on the system.
That's it.
Researchers dropped a 732-byte Python script that weaponizes this to overwrite a setuid binary like /usr/bin/su, injects shellcode, and spawns a root shell. No disk writes. No races. No KASLR bypass needed. Works reliably across Ubuntu, RHEL, Amazon Linux, SUSE — basically every major distribution built since 2017. It even crosses container boundaries because the page cache is shared at the host level.
It's not flashy memory corruption. It's elegant. It's reliable. It's the kind of bug that makes security researchers weep with joy and defenders cry. Now Add Iran's Self-Imposed Digital Blackout
The regime proudly announces it's cutting internet access "due to cyber attacks." The real reason, of course, is fear of its own population. Connectivity gets throttled or severed, updates stop flowing, and systems remain frozen in their pre-disclosure state.
This creates the perfect storm:
Many Iranian government, military, and critical infrastructure servers are still running vulnerable kernels (4.14 through early 6.x series).
The "cyber attack" excuse conveniently prevents normal sysadmins from pulling the latest patches.
Anyone who already has a local shell whether a disgruntled insider, a compromised low-priv account, a previous breach, or a clever actor who got in before the blackout — now holds the keys to the kingdom with 732 bytes of Python.
Picture this dark comedy in action:
A low-level IT guy (or an opposition sympathizer, or a foreign operator) who still has internal network access runs the PoC. Four bytes later, /usr/bin/su is politely modified in memory. execve() and suddenly he's root on servers the regime thought were "protected" by disconnecting them from the outside world.
No C2 callbacks needed. No noisy exfiltration during the blackout. Just quiet persistence and lateral movement inside the isolated network. The digital iron curtain doesn't stop internal threats it amplifies them. The Ironic Masterpiece
The regime cuts the internet out of paranoia about its people, then leaves its infrastructure wide open to the exact kind of local escalation that paranoid regimes should fear most. It's like boarding up all the windows to stop outsiders from looking in, while leaving the front door unlocked and posting a sign that says "Free Root Access Inside."
In short: Copy Fail turns any local foothold into full root with almost zero effort. Iran's self-imposed isolation ensures that many systems won't see patches for days or weeks. The combination is comedy gold for anyone on the wrong side of the regime and a nightmare for those supposedly "securing" the infrastructure.
Stay patched, folks. And if you're running critical systems in a country currently experiencing a "cyber attack" blackout... good luck. You're going to need it more than most.
489
490
491
492
493
494
495
496
497
498
499
348
Trump uses Correspondents’ Dinner shooting to justify expanding spying powers as deadline nears
(therealnews.com)
cross-posted from: https://hexbear.net/post/8356680
cross-posted from: https://news.abolish.capital/post/45407
This story originally appeared in Common Dreams on April 27, 2026. It is shared here under a Creative Commons (CC BY-NC-ND 3.0) license.
An exchange of gunfire between an armed suspect and law enforcement outside the White House Correspondents’ Dinner on Saturday came days ahead of a deadline for extending far-reaching government surveillance powers, and President Donald Trump wasted no time in claiming that the attempted attack on the event proved that the FBI must be permitted to spy on Americans without obtaining warrants.
In an interview with Fox News Sunday, Trump repeated his previous remarks that he is “willing to give up [his] security” in favor of extending Section 702 of the Foreign Intelligence Surveillance Act (FISA), which is set to expire on Thursday—and suggested other Americans should do the same for “the safety of our nation.”
Section 702 allows US intelligence agencies to surveil the electronic communications of foreign nationals overseas without a warrant. Since some of the nearly 350,000 foreign nationals whose communications have been collected under the law are in touch with Americans, Section 702 allows for the collection of emails, text messages, and phone calls of US citizens.
Fox anchor Jacqui Heinrich emphasized that “we don’t know right now” whether the suspect in Saturday’s shooting, Cole Tomas Allen, “was radicalized” by a foreign individual or group, but asked whether the attack drove home “the importance of having these tools to protect our country from these kinds of threats.”
The president responded by complaining that former FBI Director James Comey used FISA to obtain warrants to surveil a former Trump aide as part of the agency’s investigation into the 2016 Trump presidential campaign’s communications with Russia, before saying FISA has been used in the US-Israeli war on Iran and in the US military’s invasion of Venezuela earlier this year.
“It’s really needed for national security,” said Trump. “Iran is decimated, and we got a lot of information by using FISA… I’m willing to give up my security for the military because ultimately that’s to me the highest cause is, you know, the safety of our nation.”
Pres. Trump, under prodding from Fox News, exploits White House Correspondents' Dinner shooting to push for Congress to approve FISA domestic spying program: "It's really needed for national security…"
He reiterates that he's willing to give up his liberties for safety. pic.twitter.com/tmcepp0Wgn
— Chris Menahan 🇺🇸 (@infolibnews) April 26, 2026
Jordan Liz, an associate professor of philosophy at San José State University, wrote last week in a column at Common Dreams that while Trump, Republican lawmakers, and US intelligence agencies “make sweeping claims about the terror attacks that Section 702 has prevented, there is little publicly available evidence to support this.”
“According to the Cato Institute, there is only one well-documented, independently corroborated case of Section 702 preventing a terrorist attack on American soil: the 2009 New York subway bombing plot,” wrote Liz. “In that case, Section 702 was used by the [National Security Agency] to track an exchange between an al-Qaeda courier and Najibullah Zazi, who was living in the US. The NSA passed this information to the FBI, which identified Zazi and disrupted the attack before it took place. Importantly, however, the NSA allegedly received the courier’s foreign email address from the government’s British intelligence partners. At best then, this success was a byproduct of productive intelligence sharing between allies. Rather than proving the necessity of Section 702, this incident underscores how Trump’s inane attacks against key US allies undermine our national security.”
The suspect in Saturday’s shooting is believed to have acted alone, and no evidence has been released that he was in communication with any foreign entities. A document he wrote alluded to his Christian beliefs and to reports of the administration’s abuse of immigrants in detention centers, its boat-bombing operations in the Caribbean Sea and eastern Pacific Ocean, and the bombing of an elementary school in Iran.
The president has been pushing in recent weeks for an extension of Section 702. The program was last reauthorized in 2024, and earlier this month two efforts to extend the program—one for 18 months and the other for five years—failed, with opponents objecting to a lack of privacy reforms and to a loophole allowing data brokers to sell private information about Americans to government agencies that have not obtained judicial approval to seize the data.
After those proposals failed, House Speaker Mike Johnson (R-La.) last week unveiled a new bill to extend Section 702 for three years and require the FBI to submit monthly reports on its reviews of Americans’ private data to an oversight official, as well as imposing penalties for abuse—provisions that were dismissed by privacy advocates.
The House Rules Committee was set to convene on Monday, a step toward advancing the new bill toward a vote in the House, and according to NPR, Rep. Jamie Raskin (D-Md.) circulated a memo late last week urging his colleagues to reject the Republicans’ latest proposal.
The bill, he wrote, “continues the disastrous policy of trusting the FBI to self-police and self-report its abuses of Section 702 and backdoor searches of Americans’ data… FBI agents can still collect, search, and review Americans’ communications without any review from a judge.”
Four Democrats in the House—Reps. Josh Gottheimer (D-NJ), Tom Suozzi (D-NJ), Marie Gluesencamp Perez (D-Wash.), and Jared Golden (D-Maine)—broke with the party and joined the GOP earlier this month in supporting a procedural vote to advance the reauthorization of Section 702, and privacy advocates are ramping up pressure on them to oppose the latest proposal for an extension.
“It all comes down to those four and where they are going to land,” Hajar Hammado, a senior policy adviser at Demand Progress, told The Intercept Monday, “and if they are going to continue to try to hand Trump and [White House homeland security adviser] Stephen Miller warrantless surveillance authorities without any sort of checks or reforms that make sure they’re not violating civil liberties.”
From The Real News Network via This RSS Feed.
500