1561
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 1,584 posts.
1562
Run your own CTF: Stripe publishes VM images
Online payment processing for internet businesses. Stripe is a suite of payment APIs that powers commerce for businesses of all sizes.
1563
1564
An Armful of CHERIs
Microsoft Security Response Center Blog2022105 points24 commentscited by 3Security & Privacy details
Today, Arm announced that the first silicon supporting the Morello prototype architecture, a research project led by Arm, Microsoft, University of Cambridge and others, is now available on a limited run of demonstration boards, which are being shipped from today to industry partners for testing. Morello is the first…
1565
1566
TPM Sniffing
TL;DR : we reproduced Denis Andzakovic’s proof-of-concept showing that it is possible to read and write data from a BitLocker-protected device (for instance, a stolen laptop) by sniffing the TPM key from the LCP bus.
1567
The real reason for large DDoS attacks? It's IP Spoofing, not memcached
A week ago we published a story about new amplification attacks using memcached protocol on UDP port 11211. A few things happened since then: Github announced it was a target of 1.3Tbps memcached attack. OVH and Arbor reported similar large attacks with the peak reported at 1.7Tbps.
1568
A Few Thoughts on Ray Ozzie’s “Clear” Proposal
Yesterday I happened upon a Wired piece by Steven Levy that covers Ray Ozzie’s proposal for “CLEAR”. I’m quoted at the end of the piece (saying nothing much), so I knew the piece was coming. …
1569
The security scanner that cried wolf
If you’ve ever been alarmed by how many security vulnerabilities your Docker image has, even after you’ve installed security updates, here’s what’s going on.
1570
1571
Ransomware gangs now outing victim businesses that don't pay
As if the scourge of ransomware wasn’t bad enough already: Several prominent purveyors of ransomware have signaled they plan to start publishing data stolen from victims who refuse to pay up. To make matters worse, one ransomware gang has now created a public Web site identifying recent victim companies that have…
1572
1573
1574
1575
Insecure by design: protocols for encrypted phone calls
The MIKEY-SAKKE protocol is being promoted by the UK government as a better way to secure phone calls. The reality is that MIKEY-SAKKE is designed to offer minimal security while allowing undetectable mass surveillance, through the introduction a backdoor based around mandatory key-escrow. This weakness has…
1576
Distribution packages considered insecure
If you ever have run a Linux-based operating system you are probably aware of the way that software is usually distributed on them: Using a software repository. Repositories are great for numerous …
1577
Huawei HKSP Introduces Trivially Exploitable Vulnerability in the Linux Kernel
Huawei has seemingly stepped its foot into the kernel self-protection game with the release of HKSP. Absent any threat model and riddled with weaknesses, it also introduces a trivially exploitable local root vulnerability due to a complete lack of defensive programming.
1578
One way to fix your rubbish password database
Suppose for a moment that you are running a web site that has a poorly implemented password database that stores password hashes using some...
1579
Defense Against AI-Guided Traffic Analysis (Daita)
Even if you have encrypted your traffic with a VPN (or the Tor Network), advanced traffic analysis is a growing threat against your privacy. Therefore, we now introduce DAITA.
1580
Systemd's DynamicUser feature is currently dangerous
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
1581
My Letter to the Tor Project
N ow I a fourfold vision see A nd a fourfold vision is given to me T is fourfold in my supreme delight A nd three fold in soft Beulahs night A nd twofold Always. May God us keep F rom Single vision & Newtons sleep. — W illiam B lake
1582
Arbitrary code execution via ldd utility
The `ldd` utility is more vulnerable than you think. It's frequently used by programmers and system administrators to determine the dynamic library dependencies of executables. Sounds pretty innocent, right? Wrong! In this article I am going to show you how to create an executable that runs arbitrary code if it's...
1583
1584
