631
Everyone knows all the apps on your phone
Until a few years ago, any app you installed on an Android device could see all other apps on your phone without your permission.
New
The latest blog posts to take off on Hacker News. 4,333 posts.
632
Whose code am I running in GitHub Actions?
I wanted to know what third-party code I was using in my GitHub Actions. I was able to use standard text processing tools and shell pipelines to get a quick tally.
633
Entropy Attacks
The conventional wisdom is that hashing more entropy sources can't hurt: if H is any modern cryptographic hash function then H(x,y,z) is at least as good a random number as H(x,y), no matter how awful z is. So we pile one source on top of another, hashing them all together and hoping that at least one of them is good.
634
A Sneaky Phish Just Grabbed My Mailchimp Mailing List
You know when you're really jet lagged and really tired and the cogs in your head are just moving that little bit too slow? That's me right now, and the penny has just dropped that a Mailchimp phish has grabbed my credentials, logged into my account and exported
635
I won't connect my dishwasher to your cloud
This weekend I had to buy a new dishwasher because our old GE died. I bought a Bosch 500 series because that's what Consumer Reports recommended, and more importantly, I could find one in stock. After my dad and I got it installed, I went to run a rinse cycle, only to find that that, along with features like delayed…
636
Achieving Great Privacy with Safari
Browsers have always been an arena for fighting and flaming over why your browser is the best and has the most features, while all others are inferior and un...
637
Heap-overflowing Llama.cpp to RCE
Retr0's Threat Research
638
639
NixOS and reproducible builds could have detected the xz backdoor
In March 2024, a backdoor was discovered in xz, a (de)-compression software that is regularly used at the core of Linux distributions to unpack source tarballs...
640
When you deleted /lib on Linux while still connected via SSH (2022)
Let's first not talk about why this can happen, but deleting /lib, /usr/lib, or some other essential runtime files happens quite a lot (as you can see: here, here, here, and here). In this post, I will only discuss what happens when you delete /lib on Linux and how to recover from that. The easy
641
Leaking Passwords and more on macOS
A security research blog.
642
I fear for the unauthenticated web
LLM and AI companies seem to all be in a race to breathe the last breath of air in every room they stumble into. This practice started with larger websites, ones that already had protection from ma...
643
Block AI Scrapers with Anubis proof-of-work
I got tired with all the AI scrapers that were bullying my git server, so I made a tool to stop them for good.
644
Doge to Fired CISA Staff: Email Us Your Personal Data
A message posted on Monday to the homepage of the U.S. Cybersecurity & Infrastructure Security Agency (CISA) is the latest exhibit in the Trump administration’s continued disregard for basic cybersecurity protections. The message instructed recently-fired CISA employees to get in touch so they can be rehired and then…
645
646
CVE-2024-9956 – PassKey Account Takeover in All Mobile Browsers
Phishing PassKeys credentials using browser intents
647
Moving away from US cloud services
Relying on US cloud services poses legal and political risks for EU users, so I'm moving away from US cloud services. Here's how and why I did it.
648
Zero-knowledge proofs, encoding Sudoku and Mario speedruns without semantic leak
We published our video on zero-knowledge proofs! Surprisingly, making this video took a lot of work. Zero-knowledge proofs for coloring are one of those algorithms that, in hindsight, seem beautifu…
649
Extracting content from an LCP “protected” ePub
As Cory Doctorow once said "Any time that someone puts a lock on something that belongs to you but won't give you the key, that lock's not there for you." But here's the thing with the LCP DRM scheme; they do give you the key! As I've written about previously, LCP mostly relies on the user entering their password (the…
650
Decrypting encrypted files from Akira ransomware using a bunch of GPUs
I recently helped a company recover their data from the Akira ransomware without paying the ransom. I'm sharing how I did it, along with the full source code. Update: since this article was written, a new version of Akira ransomware has appeared that can't be decrypted with this method The c
651
A 2FA app that tells you when you get `314159` (2024)
An indie project for early 2010s internet addicts
652
Hidden Messages in Emojis and Hacking the US Treasury
On December 30th, while most of us were preparing for a New Year’s Eve celebration, the US Treasury was prepping a notice to lawmakers to notify them that their systems, which (obviously) contain highly sensitive, confidential data, had been compromised.
653
Recursion kills: The story behind CVE-2024-8176 in libexpat
libexpat is a fast streaming XML parser. Alongside libxml2, Expat is one of the most widely used software libre XML parsers written in C, specifically C99. It is cross-platform and licensed under the MIT license .
654
The insecurity of telecom stacks in the wake of Salt Typhoon
Towards the end of last year, we learned that a group (allegedly affiliated with the Chinese government, referred to as “Salt Typhoon”) breached T-Mobile and other telecommunications co…
655
My Scammer Girlfriend: Baiting a Romance Fraudster
Romance fraud has been growing as an issue for years. It's not uncommon to see news stories with bewildered victims explaining just how deeply they'd been sucked in. After receiving a number of opener
656
Apple Exclaves
Enhancing kernel isolation, one step at a time.
657
Feds Link Cyberheist to 2022 LastPass Hacks
In September 2023, KrebsOnSecurity published findings from security researchers who concluded that a series of six-figure cyberheists across dozens of victims resulted from thieves cracking master passwords stolen from the password manager service LastPass in 2022. In a court filing this week, U.S. federal agents…
658
How to distrust a CA without any certificate errors
A “distrust” is when a certification authority (CA) that issues HTTPS certificates to websites is removed from a root store because it is no longer trusted to issue certificates. This means certificates issued by that CA will be treated as invalid, likely causing certificate error interstitials in any browser that…
659
Exploring the Paramilitary Leaks
In January, Distributed Denial of Secrets published over 200 gigabytes of chat logs and recordings from paramilitary groups and militias, including American Patriots Three Percent (APIIII) and the Oath Keepers. The files were obtained by John Williams, a wilderness survival trainer who spent years deep undercover…
660
NCSC, GCHQ, UK Gov't expunge advice to “use Apple encryption”
This is some really embarrassing timing on the Home Office’s (HO’s) part: a few weeks ago when news first broke of the HO’s demand for a backdoor in Apple ADP, I pointed out to MP…