1141
New
The latest blog posts to take off on Hacker News. 4,333 posts.
1142
Top suspect in 2015 Ashley Madison hack committed suicide in 2014
When the marital infidelity website AshleyMadison.com learned in July 2015 that hackers were threatening to publish data stolen from 37 million users, the company’s then-CEO Noel Biderman was quick to point the finger at an unnamed former contractor. But as a new documentary series on Hulu reveals [ SPOILER ALERT! ]…
1143
Sinkholed: A DNS Horror Story (2019)
On 26 Nov 2019 at 14:55 UTC, I logged into my server that hosts my website to perform a simple maintenance activity. Merely three minutes later, at 14:58 UTC, the domain name susam.in used to host this website was transferred to another registrant without any authorisation by me or without any notification sent to me…
1144
I want XAES-256-GCM/11
I want the extended-nonce 256-bit reduced-rounds XAES-256-GCM/11 AEAD. It has infinitely randomizable nonces, a comfortable margin of multi-user security, and nearly the same performance as AES-128-GCM. Only issue is that it doesn’t exist.
1145
Firefox 115 can remotely disable any extension on any site
Firefox version 115.0 was released on July 4, but I'm not celebrating. I'm concerned about a new "feature" in the release notes .
1146
Passwords Are Fine
How we can be better at authentication security
1147
Self-driving cars are surveillance cameras on wheels
Police are already using self-driving car footage as video evidence: While security cameras are commonplace in American cities, self-driving cars represent a new level of access for law enforcement and a new method for encroachment on privacy, advocates say. Crisscrossing the city on their routes, self-driving cars…
1148
A child’s privacy is worth more than likes (2022)
The Privacy Whisperer, by Luiza Jarovsky
1149
Modern TLS/SSL on 16-bit Windows
Lately, there's been an resurgence of new programs written for retro computers—everything from a Slack client to many Wordle clones, to a Mastodon client. But most of these programs, if they connect to the Internet, require a proxy running on a modern computer to handle the SSL/TLS connection, which almost all APIs…
1150
Discovering that a Bluetooth car battery monitor is siphoning location data
Reverse engineering an Android app for a Bluetooth connected car battery monitor with some startling discoveries ...
1151
Google has a secret browser hidden inside the settings
My most popular article about Google - breakthrough in gms
1152
SMS phishers harvested phone numbers, shipment data from UPS tracking tool
The United Parcel Service (UPS) says fraudsters have been harvesting phone numbers and other information from its online shipment tracking tool in Canada to send highly targeted SMS phishing (a.k.a. “smishing”) messages that spoofed UPS and other top brands. The missives addressed recipients by name, included details…
1153
Did I receive fraudulent DMCA takedowns?
I received 3 DMCA takedown emails today, covering 7350 URLs on my hardbin.com IPFS gateway. The URLs were allegedly serving infringing copies of books. The strange part is that of those 7350 URLs, during the time for which I have nginx logs, none of them have ever been accessed , and of the ones that I checked, none…
1154
I don't trust Signal
I don't trust Signal because it pretends to be things which it provably isn't and forces use of their controlled the network. This means that if Signal wanted to, they could intercept messages. In this article I show receipts, that while each individual issue is not back-breaking: casts huge doubts to me on if i…
1155
Swing VPN app is a DDoS botnet
tldr: Swing VPN is using its user base to DDOS sites using its users as a an attack botnet. Introduction It all started with a friend of mine complaining that his phone was doing a request to a specific app every few seconds. Initial assumption was that the phone was infected with a virus but a 2 minute investigation…
1156
Put an io_uring on it – Exploiting the Linux Kernel (2022)
Put an io_uring on it - Exploiting the Linux Kernel - chompie at the bits
1157
Recovering secret keys from devices using video footage of their power LED
Exploiting a Video Camera's Rolling Shutter to Recover Secret Keys from Devices Using Video Footage of Their Power LED
1158
I may be the only evil (bit) user on the internet (2015)
Almost every year a joke RFC is made on April 1st (these have caught on so well, that it’s now common to see more than one of these every year), or April Fool’s Day, and some of them are pretty great. Here are some of my favourites:
1159
NVD Damage Continued
There is something about having your product installed in over twenty billion instances all over the world and even out of the globe. In my case it helps me remain focused on and committed to working on the security aspects of curl. Ideally, we will never have our heartbleed moment. Security is also a generally ……
1160
Desktop Linux Hardening (2022)
Linux is not a secure desktop operating system. However, there are steps you can take to harden it, reduce its attack surface, and improve its privacy. Before we start… Some of the sections will include mentions of unofficial builds of packages like linux‑hardened, akmod, hardened_malloc, and so on. These are not…
1161
The Dutch government wants automatic permission to target victims of hackers
This is a mirror of the original about:intel post, since the about:intel server is sadly sometimes overloaded. Also do read the opposing view from Jan-Jaap Oerlemans and the reflection by Lotte Houwing The Dutch government is proposing adding a lex specialis to its existing intelligence and security services act. This…
1162
1163
Barracuda urges replacing, not patching, its email security gateways
It’s not often that a zero-day vulnerability causes a network security vendor to urge customers to physically remove and decommission an entire line of affected hardware — as opposed to just applying software updates. But experts say that is exactly what transpired this week with Barracuda Networks , as the company…
1164
I'm Not Invidious
TheFrenchGhosty's Blog
1165
Another cluster of potentially malicious Chrome extensions
I discovered a cluster of at least 109 extensions in Chrome Web Store. A few are committing affiliate fraud or spying, most are simply hoarding overly wide privileges before abusing them.
1166
Phishing Darknet Users for Bitcoins
Writeup of a tool for creating bitcoin stealing phishing clones of onion services on large scale
1167
GitHub Private Repos Considered Private-Ish
This week, we discovered that GitHub.com’s RSA SSH private key was briefly exposed in a public GitHub repository.
1168
Calling time on DNSSEC: The costs exceed the benefits
I’m calling time on DNSSEC. Last week, prompted by a change in my DNS hosting setup, I began removing it from the few personal zones I had signed. Then this Monday the .nz ccTLD experienced a multi-day availability incident triggered by the annual DNSSEC key rotation process. This incident broke several of my unsigned…
1169
1170
More malicious extensions in Chrome Web Store
So far I discovered 18 malicious extensions with 55 million users in total. Most popular ones are: Autoskip for Youtube, Crystal Ad block and Brisk VPN. They have been active for two years, undetected by Google.