781
We outsmarted CSGO cheaters with IdentityLogger
Learn how IdentityLogger used fingerprinting to combat ban evasion, protecting our CSGO community from relentless cheaters.
New
The latest blog posts to take off on Hacker News. 4,333 posts.
782
ACF has been hijacked
It’s super late at night on Thanksgiving weekend in Canada. I shouldn’t be thinking about weird internet drama, but here we are.
783
Can you get root with only a cigarette lighter?
Before you can write an exploit, you need a bug. When there are no bugs, we have to get creative—that's where Fault Injection comes in. Fault injection can take many forms, including software-controlled data corruption, power glitching, clock glitching, electromagnetic pulses, lasers, and more.
784
Attacking UNIX Systems via CUPS
Hello friends, this is the first of two, possibly three (if and when I have time to finish the Windows research) writeups. We will start with targeting GNU/Lin…
785
Hacking Kia: Remotely controlling cars with just a license plate
On June 11th, 2024, we discovered a set of vulnerabilities in Kia vehicles that allowed remote control over key functions using only a license plate. These attacks could be executed remotely on any hardware-equipped vehicle in about 30 seconds, regardless of whether it had an active Kia Connect subscription.
786
Timeshare owner? The Mexican drug cartels want you
The FBI is warning timeshare owners to be wary of a prevalent telemarketing scam involving a violent Mexican drug cartel that tries to trick people into believing someone wants to buy their property. This is the story of a couple who recently lost more than $50,000 to an ongoing timeshare scam that spans at least two…
787
Preventing app removal on iOS
These days, I am developing an alarm app called ‘SuperAlarm’. To ensure a user is awake, SuperAlarm can be turned off only after a user completes a mission(e.g., taking a picture...
788
They stole my voice with AI
UPDATE 9/23: The CEO of Elecrow responded. I've posted a follow-up blog post with my reaction to the response and some other thoughts on AI voice cloning. Listen to this clip: Your browser does not support the video tag. I don't know about you, but that sounds pretty familiar. I mean I would like you to subscribe to…
789
Using YouTube to steal your files
A writeup of my $4133.70 Google Drive vulnerability chain.
790
Gaining access to anyones Arc browser without them even visiting a website
gaining access to anyones browser without them even visiting a website
791
Visual guide to SSH tunneling and port forwarding (2023)
Sysadmin doing syadmin stuff
792
GitHub notification emails used to send malware
Malicious actors are abusing legitimate notification emails sent by GitHub to try and trick people into downloading malware.
793
Turning Everyday Gadgets into Bombs Is a Bad Idea
I think turning everyday gadgets into bombs is a bad idea. However, recent news coverage has been framing the weaponization of pagers and radios in the Middle East as something we do not need to concern ourselves with because “we” are safe.
794
Digital signatures and how to avoid them
Wikipedia’s definition of a digital signature is: A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents. A valid digital signature on a messag…
795
Fixing an Elgato HD60 S HDMI capture device with the help of Ghidra
This post has a little bit of everything. Hardware diagnostics, some suspiciously similar datasheets from two separate Taiwan chip manufacturers, and firmware reverse engineering. Read on if that sounds like fun!
796
How Chainalysis made their way into popular Monero wallets
An investigation into how malicious nodes run by Chainalysis made their way into defaults of popular Monero wallets.
797
Lazarus Group laundered $200M from 25 crypto hacks to fiat
Bluenoroff or APT38, more commonly referred to as Lazarus Group is a threat group which has been tied to the North Korean government since as early as 2009 primarily being financially motivated utilizing malware custom built for each target.
798
Zero-Click Calendar invite vulnerability chain in macOS
Critical zero-click vulnerability chain in macOS (patched)
799
OpenSSH Keystroke Obfuscation Bypass
A disclosure for an OpenSSH keystroke obfuscation bypass affecting current OpenSSH versions after 9.4.
800
Our Git Hash Bug
Things this developer thinks might be interesting to you.
801
802
Baiting the bot
LLM chatbots can be engaged in endless "conversations" by considerably simpler text generation bots. This has some interesting implications.
803
The "email is authentication" pattern
By Ruben Schade in Eora/Sydney, Australia.
804
Cracking an old ZIP file to help open source the ANC's "Vula" secret crypto code
It's not often that you find yourself staring at code that few people have ever seen, code that was an important part in bringing down the a...
805
The Insecurity of Debian
The difference in security defaults between Debian and Red Hat.
806
IPMI
I am making steady progress towards moving the Computers Are Bad enterprise cloud to its new home, here in New Mexico. One of the steps in this process is, of course, purchasing a new server... the current Big Iron is getting rather old (probably about a decade!) and here in town I'll have the rack space for more…
807
Owners of 1-Time Passcode Theft Service Plead Guilty
Three men in the United Kingdom have pleaded guilty to operating otp[.]agency , a once popular online service that helped attackers intercept the one-time passcodes (OTPs) that many websites require as a second authentication factor in addition to passwords.
808
I'm blocking connections from AWS to my on-prem services
The direct result of bulletproof infrastructure / cloud providers which are "too big to fail" is the balkanized internet . I don't think this has fully come to pass, but it might be starting to happen or might come to pass soon.
809
Firewall rules: not as secure as you think
A post outlining tricks for firewall privilege escalation
810
Bypassing airport security via SQL injection
We discovered a serious vulnerability in the Known Crewmember (KCM) and Cockpit Access Security System (CASS) programs used by the Transportation Security Administration.