1291
Exploiting the Wi-Fi Stack on Apple Devices
Posted by Gal Beniamini, Project ZeroIn this blog post we’ll complete our goal of achieving...
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 1,584 posts.
1292
HealthCare.gov Sends Personal Data to Dozens of Tracking Websites
The Associated Press reports that healthcare.gov–the flagship site of the Affordable Care Act, where millions of Americans have signed up to receive health care–is quietly sending personal health information to a number of third party websites. The information being sent includes one's zip code,...
1293
1294
How the Dreamcast Copy Protection Was Defeated
After I shipped the DOOM Black Book , I took some vacation in Japan where I was able to play Ikaruga on a real arcade at Taito HEY in Akihabara. The experience reignited my interest in SEGA's ultimate video game console, the Dreamcast. There is a lot of documentation available online which made the studying process…
1295
Mozilla solves the Manifest V3 puzzle to save ad blockers
Google Chrome's new platform for extensions, Manifest V3, threatens to limit the functionality of ad blockers. Firefox has found a way around this problem. Read how.
1296
Extracting Qualcomm's KeyMaster Keys – Breaking Android Full Disk Encryption
A security blog focusing on Android, the Linux Kernel and everything nice.
1297
1298
How I Made a Heap Overflow in Curl
In association with the release of curl 8.4.0, we publish a security advisory and all the details for CVE-2023-38545. This problem is the worst security problem found in curl in a long time. We set it to severity HIGH. While the advisory contains all the necessary details. I figured I would use a few additional ……
1299
Double Blind Passwords a.k.a. Horcruxing
Before we get into Horcruxing, here's a quick prologue on online security hygiene. You can skip to the Horcruxing section if it seems redundant. 1. Longer…
1300
Remote code execution in cdnjs of Cloudflare
Preface (日本語版も公開されています。) Cloudflare, which runs cdnjs, is running a “Vulnerability Disclosure Program” on HackerOne, which allows hackers to perform vulnerability assessments. This article describes vulnerabilities reported through this program and published with the permission of the Cloudflare security team. So this…
1301
Top downloaded skill in ClawHub contains malware
The same capabilities that make OpenClaw a groundbreaking tool also make it an urgent security risk. This blog contains confirmed examples of agent skills being used as malware vectors, and advice on how to protect yourself if you're experimenting with them.
1302
Anonymous Source Shared Leaked Google Search API Documents
Update: We are diving deep into the Google API leak and what it means for marketers in our next episode of SparkToro Office Hours on June 27. Join Michael
1303
BusKill: A kill cord for your laptop
BusKill is a Kill Cord for your laptop implementing a Dead Man Switch using $20 in USB hardware + udev rule to trigger your laptop self-destruct if stolen.
1304
I use C when I believe in memory safety
I am using C for a professional project. I believe in memory safety. Yes, I'm a hypocrite, but please, let me explain.
1305
State Partitioning
State Partitioning is the new privacy feature called Total Cookie Protection, which will be available in ETP Strict Mode in Firefox 86.
1306
Mozilla Drops Onerep After CEO Admits to Running People-Search Networks
The nonprofit organization that supports the Firefox web browser said today it is winding down its new partnership with Onerep , an identity protection service recently bundled with Firefox that offers to remove users from hundreds of people-search sites. The move comes just days after a report by KrebsOnSecurity…
1307
A deep dive on a Facebook reseller of bikes stolen in Colorado
Bike Index tracks a Colorado-to-Mexico stolen bike pipeline - and learns things along the way
1308
Mozilla Recognized as Most Trusted Internet Company for Privacy
I’m very happy to share that Mozilla has been named the Most Trusted Internet Company for Privacy in 2012, according to a study performed by the Ponemon
1309
Npm operational incident, 6 Jan 2018
npm Blog (Archive); updates from the npm team are now published on the GitHub Blog and the GitHub Changelog
1310
The RCE that AMD wouldn't fix
Following backlash, AMD agreed to fix an MITM RCE I discovered in Ryzen Master. All in all, it took them over four months to roll out the fix.
1311
1312
Hackers stole access tokens from Okta's support unit
Okta , a company that provides identity tools like multi-factor authentication and single sign-on to thousands of businesses, has suffered a security breach involving a compromise of its customer support unit, KrebsOnSecurity has learned. Okta says the incident affected a “very small number” of customers, however it…
1313
Cracking an old ZIP file to help open source the ANC's "Vula" secret crypto code
It's not often that you find yourself staring at code that few people have ever seen, code that was an important part in bringing down the a...
1314
What is BGP? – BGP routing explained
Border Gateway Protocol (BGP) is the routing protocol for the Internet. Much like the post office processing mail, BGP picks the most effecient routes for delivering Internet traffic.
1315
Let's Reverse Engineer Discord
How we reverse engineered Discord’s call protocol and found it being MITM-ed by Discord.
1316
The Policy Puppetry Attack: Novel bypass for major LLMs
HiddenLayer’s latest research uncovers a universal prompt injection bypass impacting GPT-4, Claude, Gemini, and more, exposing major LLM security gaps.
1317
French court: refusing to disclose mobile passcode to law enforcement is a crime
The French Court of Cassation has ruled that people who are suspected or accused of a crime are obliged to reveal the passcode of their mobile phone to the investigative authorities.
1318
Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it
This week we released our authorisation flow making it possible for you to go from building apps that talk to your bank account, to building apps that can talk to any bank account. This is huge. Check out this SMS bot (how on trend) I hacked up yesterday morning. (and don’t forget to join the beta wait list ).
1319
Distrust of Symantec TLS Certificates
A Certification Authority (CA) is an organization that browser vendors (like Mozilla) trust to issue certificates to websites. Last year, Mozilla published and discussed a set of issues with one ...
1320
Memory safety for web fonts
Learn how and why the Chrome team has replaced FreeType with Skrifa.