31
Instagram's Million Dollar Bug
How participation in Facebook's bug bounty not only led to the complete compromise of Instagram, but also legal threats and intimidation
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 93 posts.
32
Extracting the SuperFish certificate
I extracted the certificate from the SuperFish adware and cracked the password (" komodia ") that encrypted it. I discuss how down below. T...
33
Auditing GitHub users’ SSH key quality
If you have just/as of late gotten an email about your keys being revoked, this is because of me, and if you have, you should really go through and make sure that no one has done anything terrible to you, since you have opened yourself to people doing very mean things to you for what is most likely a very long time.
34
35
Important Notice Regarding Public Availability of Stable Patches
grsecurity is the only drop-in Linux kernel replacement offering high-performance, state-of-the-art exploit prevention against both known and unknown threats.
36
Hacking Starbucks for unlimited coffee
We do penetration testing, source code auditing and vulnerability assessments
37
38
39
What happens when DNS in China is poisoned and pointed at your server
I’ve been using the Internet in one form or another since the mid-80’s. In that time, I’ve seen a lot of strange stuff happening on our global network. On Tuesday, I experienced something extraordinary. It all started with a text message from my partner Ged at 8:30 AM: Mail server down. Please take a look […]
40
Reassessing Airport Security
News that the Transportation Security Administration missed a whopping 95% of guns and bombs in recent airport security “red team” tests was justifiably shocking. It’s clear that we’re not getting value for the $7 billion we’re paying the TSA annually. But there’s another conclusion, inescapable and disturbing to…
41
42
China's Man-On-the-Side Attack on GitHub
On March 27 The following message was posted on the official GitHub blog: We are currently experiencing the largest DDoS (distributed denial of service) attack in github.coms history. The attack began around 2AM UTC on Thursday, March 26, and involves a wide combination of attack vectors. These incl[...]
43
44
Microsoft’s new small print – how your personal data is abused
Microsoft has renewed its Privacy Policy and Service Agreement. The new services agreement goes into effect on 1 August 2015, only a couple of days after the launch of the Windows 10 operating system on 29 July. The new “privacy dashboard” is presented to give the users a possibility to control their data related to…
45
Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges
Posted by Mark Seaborn, sandbox builder and breaker, with contributions by Thomas Dullien, revers...
46
47
BoringSSL
We recently switched Google's two billion line repository over to BoringSSL , our fork of OpenSSL . This means that BoringSSL is now powering Chromium (on nearly all platforms), Android M and Google's production services. For the first time, the majority of Google's products are sharing a single TLS stack and making…
48
TSA Master Keys
Someone recently noticed a Washington Post story on the TSA that originally contained a detailed photograph of all the TSA master keys. It’s now blurred out of the Washington Post story, but the image is still floating around the Internet. The whole thing neatly illustrates one of the main problems with backdoors…
49
Even the LastPass Will Be Stolen
How to obtain encryption keys to decrypt the LastPass vault in different scenarios
50
Analysis of PS4's security and the state of hacking
Since there haven't been any major public announcements regarding PS4 hacking for a long time now, I wanted to explain a bit about how far PS4 hacking has come, and what is preventing further progression.
51
52
Is Extended Random a Malicious NSA Plot?
Dual_EC was almost certainly an NSA backdoor. Extended Random is the TLS extension that would have made it practical to exploit. Did NSA plant that one too? A look at the evidence.
53
Introduction to WebKit Content Blockers
Describing content blocking rules in a structured format ahead-of-time, rather than running extension-provided code.
54
Vault – A tool for managing secrets
Vault is a platform for centralized secrets management, encryption as a service, and identity-based access.
55
Thunderstrike – Apple EFI firmware vulnerability
31C3 presentation on the Thunderstrike firmware vulnerability in MacBooks
56
57
An experimental real world adblock
Corporate branding and advertisements are ubiquitous in society today and almost impossible to avoid. What if we lived in a world where consumers were blind to this surplus of corporate branding? Brand Killer is a technology demonstration that envisions a future in which consumers can use augmented reality to opt out…
58
First fully sandboxed Linux desktop app
Its not a secret that I've been working on sandboxed desktop applications recently. In fact, I recently gave a talk at devconf.cz about it. However, up until now I've mainly been focusing on the bundling and deployment aspects of the problem. I've been running applications in their own environment, but having pretty…
59
60
Sustaining Digital Certificate Security
Posted by Ryan Sleevi, Software Engineer This post updates our previous notification of a misissued certificate for google.com Followin...