3181
New
The latest blog posts to take off on Hacker News. 4,335 posts.
3182
Pwncloud – Bad crypto in the Owncloud encryption module
This blog is written by Hanno Böck. Unless noted otherwise, its content is licensed as CC0 .
3183
The 3DS Cryptosystem
I think one of the biggest challenge for system engineers is designing security. Recently, at the 32c3 conference, plutoo, derrek, and smea presented a series of hacks that completely defeated the security of the 3DS. As a result, people have implemented boot-time unsigned code execution (called “arm9loaderhax” in the…
3184
I would like Debian to stop shipping XScreenSaver
If any of you reading this have decision-making ability along those lines, I would appreciate your assistance in making this happen. If you're wondering why: they are still shipping a version of my software that I released in 2014. Since that's roughly a decade in software years, it recently began popping up a single…
3185
How Candy Japan got credit card fraud somewhat under control
Credit card fraud can be a huge problem for subscription boxes. Here's how we got our situation under control.
3186
3187
How Safe Browsing Works in Firefox
Firefox has had support for Google's Safe Browsing since 2005 when it started as a stand-alone Firefox extension . At first it was only available in the USA, but it was opened up to the rest of the world in 2006 and moved to the Google Toolbar . It then got integrated directly into Firefox 2.0 before the public launch…
3188
Let's Encrypt and Nginx – State of the art secure web deployment
An overview of a secure web deployment with Let's Encrypt and Nginx. How to set up a valid HTTPS connection, harden it and get top security ratings.
3189
The Basics of Web Application Security
Security is both very important and often under-emphasized. While many targeted techniques help, there are some basic clean code habits which every developer can and should be doing
3190
Follow the money: Apple vs. the FBI
A lot of people are watching the spectacle of Apple vs. the FBI and the Homeland Security Theatre and rubbing their eyes, wondering why Apple (in the person of CEO Tim Cook) is suddenly the knight in shining armour on the side of consumer privacy and civil rights. Apple, after all, is a goliath-sized corporate…
3191
NPM Package Hijacking From the Hijacker's Perspective
In light of recent events in the javascript community, I would like to share the story of how I came into control of more than 200 heavily…
3192
ECDSA smartphone key extraction using $2 magnetic probe
We show that modern cryptographic software on mobile phones, implementing the ECDSA digital signature algorithm, may inadvertently expose its secret keys through physical side channels: electromagnetic radiation and power consumption which fluctuate in a way that depends on secret information during the cryptographic…
3193
Alert: NPM modules hijacked
<p><strong>EDIT : User @nj48 appears to <a href="https://twitter.com/seldo/status/712673227630313472">have no malicious intentions</a>.</strong></p>
3194
My Take on FBI's “Alternative” Method
FBI acknowledged today that there “appears” to be an alternative way into Farook’s iPhone 5c – something that experts have been shouting for weeks now; in fact, we’ve been saying there are several viable methods. Before I get into which method I think is being used here, here are some possibilities of other viable…
3195
Attack of the Week: Apple iMessage
Today’s Washington Post has a story entitled “Johns Hopkins researchers poke a hole in Apple’s encryption”, which describes the results of some research my students and I have bee…
3196
StartSSL domain validation vulnerability
StartSSL certificate authority is well known for offering free domain validated SSL certificates, and also sells organisation and extended v...
3197
Counterfeit Macbook charger teardown: convincing outside but dangerous inside
What's inside a counterfeit Macbook charger? After my Macbook charger teardown , a reader sent me a charger he suspected was counterfeit. ...
3198
An XSS on Facebook via PNGs and Wonky Content Types
Bug Bounty & Application Security
3199
How your data is collected and commoditised via “free” online services
I get a lot of people popping up with data breaches for Have I been pwned [https://haveibeenpwned.com/] (HIBP). There’s an interesting story in that itself actually, one I must get around to writing in the future as folks come from all sorts of different backgrounds and offer
3200
Thomas Jefferson and Apple versus the FBI
When Prohibition began, anti-alcohol crusaders demanded that the St. Louis Public Library burn every book that explained "the home production of alcohol for drinks". The librarian insisted on keeping the books but agreed to hide them from the "general public".
3201
3202
Data is a Toxic Asset
Thefts of personal information aren’t unusual. Every week, thieves break into networks and steal data about people, often tens of millions at a time. Most of the time it’s information that’s needed to commit fraud, as happened in 2015 to Experian and the IRS. Sometimes it’s stolen for purposes of embarrassment or…
3203
Breaking homegrown crypto
Anubis could not load its JavaScript. The server may be overloaded. Please reload the page to try again.
3204
3205
Please scan my towel
My friend Scott pointed out the towels in most hotels now have RFID tags to help with inventory control: I also knew that my RSA Conference badge would have an RFID tag in it so it could be scanne…
3206
Trackers
A couple of weeks ago I went to the local shopping centre looking for a thermometer. After entering one store upon leaving without buying anything a tracker was assigned to me. I didn’t think much of it at first, but he followed me dutifully around the shopping centre, took careful note of how I walked. Whenever I…
3207
How I could have hacked any Facebook account
Note: This is being published with the permission of Facebook under the responsible disclosure policy. The vulnerability is now fixed. ...
3208
Hacking industrial vehicles from the internet
It is possible to monitor and control float trucks, public bus or delivery vans from the internet , obtaining their speed, position, and a lot other parameters. You can even control some parameters of the vehicle or hack into the canbus of the vehicle remotely.
3209
Advanced Tor Browser Fingerprinting
The ability to privately communicate through the internet is very important for dissidents living under authoritary regimes, activists and basically everyone concerned about internet privacy.
3210
Widespread XSS Vulnerabilities in Ad Network Code
For most of us, the title of this post may not be very surprising. Any time we allow 3rd party scripts to run on our sites, we effectively relinquish control of the code that executes on the client. This is particularly important when integrating ad network scripts since they are inherently more dynamic than most…