601
How are cyber criminals rolling in 2025?
Speaking of earning a living, would you expect them to pay for web hosting/ cloud providers?
New
The latest blog posts to take off on Hacker News. 4,333 posts.
602
How Obama’s BlackBerry got secured (2013)
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
603
Technical analysis of the Signal clone used by Trump officials
💡Update May 3, 2025: I have posted a follow-up, Here's the source code for the unofficial Signal app used by Trump officials. Update May 4, 2025: Another followup, and a big one: The Signal Clone the Trump Admin Uses Was Hacked Update May 6, 2025: I've written
604
xAI dev leaks API key for private SpaceX, Tesla LLMs
An employee at Elon Musk’s artificial intelligence company xAI leaked a private key on GitHub that for the past two months could have allowed anyone to query private xAI large language models (LLMs) which appear to have been custom made for working with internal data from Musk’s companies, including SpaceX , Tesla and…
605
606
Mac app launches slowed by malware scan (2024)
I've always attributed slow Xcode launches to Xcode simply sucking, but I've noticed that the FileMerge app frequently launches slowly too. When this happens, the app can take a dozen bounces in the Dock before finally opening. FileMerge resides in the folder Xcode.app/Contents/Applications/ within the Xcode bundle…
607
Pwning the Ladybird Browser
Ladybird is a relatively new browser engine originating from the SerenityOS project . Currently, it’s in pre-alpha and improving quickly. Take a look at the website and the GitHub for more information!
608
How the US defense secretary circumvents official DoD communications equipment
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
609
I Found Malware in a BeamNG Mod
An analysis using Process Monitor and WinDbg, dealing with JavaScript, WASM, and Windows shellcode.
610
Linux Kernel Exploitation: Attack of the Vsock
What started off as casual scrolling through the KernelCTF submissions quickly spiraled into a weeks-long deep dive into a deceptively simple patch - and my first root shell from a Linux kernel exploit!
611
I use zip bombs to protect my server
The majority of the traffic on the web is from bots. For the most part, these bots are used to discover new content. These are RSS Feed readers, search engines crawling your content, or nowadays AI bo
612
It's School time: Adventures in hacking an old Kindle
Jailbreaking an old Kindle and turning it into a school dashboard using Cloudflare Workers, Puppeteer, and image processing.
613
How a single line of code could brick your iPhone
Gui Rambo writes about his coding and reverse engineering adventures.
614
DOGE worker’s code supports NLRB whistleblower
A whistleblower at the National Labor Relations Board (NLRB) alleged last week that denizens of Elon Musk’s Department of Government Efficiency (DOGE) siphoned gigabytes of data from the agency’s sensitive case files in early March. The whistleblower said accounts created for DOGE at the NLRB downloaded three code…
615
Whistleblower: DOGE Siphoned NLRB Case Data
A security architect with the National Labor Relations Board (NLRB) alleges that employees from Elon Musk ‘s Department of Government Efficiency (DOGE) transferred gigabytes of sensitive data from agency case files in early March, using short-lived accounts configured to leave few traces of network activity. The NLRB…
616
How encryption for Cinema Movies works
The Cinema Industry is using its own standards for creating and distributing movies in a secure way. The DCI (Digital Cinema Initiatives) specification defines everything from file formats and encryption to the projection systems itself.
617
The Web Is Broken – Botnet Part 2
I guess you have all heard about the growing problem of AI companies trying to aggressively collect whatever data they can get their hands on to train their models. This has caused an explosive surge in web crawlers relentlessly hitting servers big and small. But who runs these crawlers? Turns out — it could be you!
618
15,000 lines of verified cryptography now in Python
In November 2022, I opened issue 99108 on Python’s GitHub repository, arguing that after a recent CVE in its implementation of SHA3, Python should embrace verified code for all of its hash-related infrastructure.
619
Everyone knows your location, Part 2: try it yourself and share the results
Learn how to record and analyse your mobile device traffic, take an app from the list of "shady" apps and share the results.
620
Hacking a Smart Home Device (2024)
How I reverse engineered an ESP32-based smart home device to gain remote control access and integrate it with Home Assistant.
621
622
Anubis Works
Xe Iaso's personal website.
623
Behind the 6-digit code: Building HOTP and TOTP from scratch
Personal website of Doğaç Eldenk.
624
Gmail E2E is as terrible as expected
Recently, Google introduced E2E encryption in Gmail. It went bad.
625
The “S” in MCP Stands for Security
Spoiler: it doesn’t. But it should.
626
AI cheats: Why you didn't notice your teammate was cheating
For the past few years, cheats have evolved rapidly. First came memory reading aimbots, then colorbots, and now AI aim assist. Cheats have escaped the host PC. How does it affect the players and anti-cheats?
627
The order of files in /etc/ssh/sshd_config.d/ matters
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
628
Hacking the call records of millions of Americans
Imagine if anyone could punch in a phone number from the largest U.S. cell carrier and instantly retrieve a list of its recent incoming calls—complete with timestamps—without compromising the device, guessing a password, or alerting the user. Now imagine that number belongs to a journalist, a police officer, a…
629
Cell Phone OPSEC for Border Crossings
I have heard stories of more aggressive interrogation of electronic devices at US border crossings. I know a lot about securing computers, but very little about securing phones. Are there easy ways to delete data—files, photos, etc.—on phones so it can’t be recovered? Does resetting a phone to factory defaults erase…
630
Oracle attempt to hide cybersecurity incident from customers?
Being a provider of cloud SaaS (Software-as-a-service) solutions requires certain cybersecurity responsibilities — including being…