Apple released security updates to address this year's first zero-day vulnerability exploited in attacks that could impact iPhones, Macs, and Apple TVs.

https://www.bleepingcomputer.com/news/apple/apple-fixes-first-zero-day-bug-exploited-in-attacks-this-year/

Security Onion 2.4 Feature o' the Day!

Configure IDS Rules:
https://blog.securityonion.net/2023/11/security-onion-24-feature-o-day_14.html

Did you ever hear about Custom Headers in #bravebrowser? Yesterday I found out that #Brave will add custom HTTP header X-Brave-Partner on websites of the Brave's partners.

Currently, it adds this header only on #Grammarly website, the reason is "Count Brave visitors as part of an ad campaign".
Also, if #Yandex is a default search index, the Brave adds special clid parameter to search requests for indicating that request originated from Brave (2423859 for Android users, 2353835 for Desktop users).

Reference: https://github.com/brave/brave-browser/wiki/Custom-Headers

In the past, the list contains several Brave partners, such as upholdm you can check the revisions of the wiki page (e.g. in 2019-2020).

Interesting fact is that in the past, this list was updated dynamically - the Brave browser downloaded a json config once a day from https://laptop-updates.brave.com/promo/custom-headers

And this feature could not be disabled: https://github.com/brave/brave-core/commit/6983876d3c2a2218dd6813ba3141cd674128fccf

Nowadays, the list of partners is hardcoded in the source code, but still it is there.

For more info see this issue and source code: https://github.com/brave/brave-browser/issues/16455
https://github.com/brave/brave-core/blob/master/components/brave_referrals/browser/brave_referrals_service.cc

Despite the custom headers and clid are same for all Brave users, it can be used to identify who uses Brave browser - in some organizations/companies it could be prohibited because of its support for Tor, and this Custom Headers and parameters can distinguish between the Brave users and others

#Privacy #Referrals #Tracking #Forensics #NetworkAnalysis