661
JTAG 'Hacking' the Original Xbox in 2023
Released in November 2001, the original Xbox was Microsoft’s first venture into the game console industry. With its hardware closely resembling a cheap but v...
New
The latest blog posts to take off on Hacker News. 4,439 posts.
662
Six day and IP address certificate options in 2025
Update: January 15, 2026 Six-day and IP address certificates are now generally available. See 6-day and IP Address Certificates are Generally Available for details. This year we will continue to pursue our commitment to improving the security of the Web PKI by introducing the option to get certificates with six-day…
663
Nevada court shuts down police use of federal loophole for civil forfeiture
RENO, Nev.—In a major victory for property rights, today a Washoe County judge ruled that Nevada law enforcement cannot use a federal program to bypass […]
664
Platforms systematically removed a user because he made "most wanted CEO" cards
On December 14, James Harr, the owner of an online store called ComradeWorkwear, announced on social media that he planned to sell a deck of “Most Wanted CEO” playing cards, satirizing the infamous “Most-wanted Iraqi playing cards” introduced by the U.S. Defense Intelligence Agency in 2003. Per the...
665
Google’s OAuth login doesn’t protect against purchasing a failed startup domain
Millions of Americans can have their data stolen right now because of a deficiency in Google’s “Sign in with Google” authentication flow. If you’ve worked for a startup in the past - especially one that has since shut down - you might be vulnerable.
666
Backdooring Your Backdoors – Another $20 Domain, More Governments
After the excitement of our .MOBI research, we were left twiddling our thumbs. As you may recall, in 2024, we demonstrated the impact of an unregistered domain when we subverted the TLS/SSL CA process for verifying domain ownership to give ourselves the ability to issue valid and trusted TLS/
667
Online Behavioral Ads Fuel the Surveillance Industry
Each time you see a targeted ad, your personal information is exposed to thousands of advertisers and data brokers through a process called “real-time bidding” (RTB). This process does more than deliver ads—it fuels government surveillance, poses national security risks, and gives data brokers easy access to your…
668
Cascading Spy Sheets: Exploiting the Complexity of Modern CSS for Fingerprinting
In an attempt to combat user tracking, both privacy-aware browsers (e.g., Tor) and email applications usually disable JavaScript. This effectively closes a major angle for user fingerprinting. However, recent findings hint at the potential for privacy leakage through selected Cascading Style Sheets (CSS) features…
669
670
671
Colliding with the SHA prefix of Linux's initial Git commit
Or, how to break all the tools that parse the "Fixes:" tag Kees Cook There was a recent discussion about how Linux's "Fixes" tag, which ...
672
673
Fighting spam with Haskell at Meta (2015)
Visit the post for more.
674
Alignment faking in large language models
A paper from Anthropic's Alignment Science team on Alignment Faking in AI large language models
675
Scanners Beware: Welcome to the network from hell
We’ve crafted a bold defense strategy that not only slows scans but actively disrupts and deceives attackers.
676
677
Clio: A system for privacy-preserving insights into real-world AI use
Anthropic's new system, Clio, analyzes how people use AI while maintaining their privacy.
678
Review of Mullvad VPN
X41 releases the audit report of Mullvad VPN
679
680
Compromising OpenWrt Supply Chain
Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc. A few days ago, I was upgrading my home lab network, and I decided to upgrade the OpenWrt on my router.1 After accessing the LuCI, which is the web interface of OpenWrt, I noticed that there is a section called Attended Sysupgrade…
681
OpenAI o1 system card
This report outlines the safety work carried out prior to releasing OpenAI o1 and o1-mini, including external red teaming and frontier risk evaluations according to our Preparedness Framework.
682
Bootkitty: Analyzing the first UEFI bootkit for Linux
ESET's discovery of the first UEFI bootkit designed for Linux sendss an important message: UEFI bootkits are no longer confined to Windows systems alone.
683
Do you need ID to read the REAL-ID rules?
[“The welcoming, friendly and visually pleasing appearance” of the TSA’s headquarters at 6595 Springfield Center Drive, Springfield, VA.]
684
Judge's Investigation into Patent Troll Results in Criminal Referrals
In 2022, three companies with strange names and no clear business purpose beyond patent litigation filed dozens of lawsuits in Delaware federal court, accusing businesses of all sizes of patent infringement. Some of these complaints claimed patent rights over basic aspects of modern life; one, for...
685
Wildlife monitoring technologies used to intimidate and spy on women
Camera traps and drones deployed by government authorities to monitor a forest in India are infringing on the privacy and rights of local women.
686
The Nearest Neighbor Attack
In early February 2022, notably just ahead of the Russian invasion of Ukraine, Volexity made a discovery that led to one of the most fascinating and complex incident investigations Volexity had ever worked. The investigation began when an alert from a custom detection signature Volexity had deployed at a customer site…
687
Security researchers identify new malware targeting Linux
ESET researchers analyzed previously unknown Linux backdoors that are connected to known Windows malware used by the China-aligned Gelsemium group, as well as to Project Wood.
688
Listen to the whispers: web timing attacks that work
Websites are riddled with timing oracles eager to divulge their innermost secrets. It's time we started listening to them. In this paper, I'll unleash novel attack concepts to coax out server secrets
689
Let's Encrypt is 10 years old now
Vital personal and business information flows over the Internet more frequently than ever, and we don’t always know when it’s happening. It’s clear at this point that encrypting is something all of us should be doing. Then why don’t we use TLS (the successor to SSL) everywhere? Every browser in every device supports…
690
DNA testing company vanishes along with its customers' genetic data
Atlas Biomed, a DNA testing company that promised clients insights into their genetic disposition has suddenly disappeared.