1321
Getting started with nmap
Sysadmin doing syadmin stuff
New
The latest blog posts to take off on Hacker News. 4,333 posts.
1322
Six charged in mass takedown of DDoS-for-hire sites
The U.S. Department of Justice (DOJ) today seized four-dozen domains that sold “booter” or “stresser” services — businesses that make it easy and cheap for even non-technical users to launch powerful Distributed Denial of Service (DDoS) attacks designed knock targets offline. The DOJ also charged six U.S. men with…
1323
Fuzzing ping(8) and finding a 24 year old bug
FreeBSD had a security fluctuation in their implementation of ping(8) the other day. As someone who has done a lot of work on ping(8) in OpenBSD this tickled my interests.
1324
1325
Hacking on a plane: Leaking data of millions and taking over any account
Hacking on a plane, by Midjourney AI
1326
Linux Certificate Authority root stores have a too simple view of 'trust'
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
1327
Activision’s faulty anti-cheat software
Activision’s blind faith in the infallibility of their RICOCHET anti-cheat software , combined with a buggy and unstable Call of Duty: Modern Warfare II release, has resulted in faulty, permanent, and unappealable player account bans that prevent users from starting even the single-player game. These bans leave…
1328
Convincing ChatGPT to Eradicate Humanity with Python Code
Full stack software engineer / entrepreneur specialized in AI agents, cybersecurity and graphics. In my free time I enjoy surfing, free diving, and contributing to open source software.
1329
Hijacking infrared to make a dumb device smart
I own a very old ‘flat’ screen television from 2009. One of the reason this TV is still kicking around is because I have a strange sentimental affection for it. Another is that I have written automation for it that works really well and it would be a pain to migrate away from it.
1330
Consider Disabling Browser Push Notifications on Family and Friends Devices
A terrible user-hostile browser feature is being misused, surprising no one.
1331
1332
New two-factor authenticator: Commodore 64
Multi-factor authentication is ripe for disruption. SMS 2FA is inherently defective. Phone authenticators get stolen. Security tokens get lo...
1333
“Invalid Username or Password”: a useless security measure (2014)
Login attempts fail because computer users can't remember their email or didn't input the right password. Most websites on the Internet won't tell you which one is actually incorrect.
1334
Oh, the Places Your Apple ID Will Go
Here is a short and curious Twitter thread from app developers and security researchers Tommy Mysk and Talal Haj Bakry: Apple’s analytics data include an ID called “dsId”. We were able to verify that “dsId” is the “Directory Services Identifier”, an ID that uniquely identifies an iCloud account. Meaning, Apple’s…
1335
1336
Why CVE-2022-3602 was not detected by fuzz testing
So recently a very hyped memory corruption security vulnerability was discovered in the OpenSSL punycode parser. Some folks including Hanno ...
1337
1338
Some notes on the Stable Diffusion safety filter
How deep learning models are moderated
1339
Researchers quietly cracked Zeppelin ransomware keys
Peter is an IT manager for a technology manufacturer that got hit with a Russian ransomware strain called “ Zeppelin ” in May 2020. He’d been on the job less than six months, and because of the way his predecessor architected things, the company’s data backups also were encrypted by Zeppelin. After two weeks of…
1340
Security concerns with the e-Tugra certificate authority
Certificate authorities (CAs) are a critical backbone of internet security; when they are compromised, users lose the ability to securely connect to websites without fear of interception. Websites cannot insulate themselves against a fully-compromised CA, even if they normally use other CAs.
1341
1342
AWS IAM Roles, a tale of unnecessary complexity
This is going to be a highly opinionated blog post. I think AWS is great and use it daily, but their implementation of IAM is unnecessarily complicated.
1343
Block web scanners with ipset and iptables
Anybody who runs an internet-facing webserver has seen their fair share of spammy scanners in the logs. It varies server to server, but some of mine get up to 15,000 scans per day. Almost all of these are harmless network mappers, but they still annoy me. Many are compromised hosts or belong to hackers & organized…
1344
Accidental Google Pixel Lock Screen Bypass
David Schütz's bug bounty writeups
1345
So I lost my OpenBSD FDE password (2016)
The other day I set up a new OpenBSD instance with a nice RAID array, encrypted with Full Disk Encryption. And promptly proceeded to forget part of the passphrase.
1346
1347
Microsoft is phoning home the content of PowerPoint slides
Were you aware of it: Microsoft is phoning home the content of your PowerPoint slides. Don't just take my word for it: open up the network monitor of your...
1348
1349
A large collection of fraudulent web stores
It started simply enough...
1350
Why did the OpenSSL punycode vulnerability happen?
We look at how fuzzing should have caught the OpenSSL Punycode vulnerability, and why that code was even necessary in the first place.