121
New
The latest blog posts to take off on Hacker News. 4,333 posts.
122
Some thoughts about Anthropic's new cryptanalysis results
Yesterday Anthropic published two new cryptanalysis results, both outputs of Claude Mythos, their (still) unreleased advanced model. The first of these results attacks a signature scheme called HAW…
123
Document-borne AI worms can self-propagate through Copilot for Word
I would like to thank Microsoft product teams and Microsoft Security Response Center (MSRC) for collaborating with me on this technical analysis and mitigation of the disclosed vulnerabilities. The editorial opinions reflected below are solely the author’s and do not necessarily reflect those of the organizations I…
124
Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles
VE Commercial Vehicles’ My Eicher platform had a critical vulnerability that let you take over anyone’s account and gain control over their vehicle fleets.
125
What does GitHub's security team even do?
Right now, there are thousands of repositories on GitHub distributing malware. Any of you can find these repositories, and you don’t need any special knowledge to do so. All you have to do is use the standard search function on the GitHub website. These repositories have been around for
126
127
Memory safety absolutists
When seeing the title of this post, I bet in some people's minds, the first thought was "Rust devs!". This connection is not unfounded. Rust devs tend to be passionate about memory safety. Some of it, I'm sure, may have been caused by a classic language wars attitude: my language is better than yours, and here is why…
128
Android may soon restrict on-device ADB
Changes proposed for ADB could kill an entire ecosystem of open-source power-user apps, mobile developer setups, and rootless privacy tools based on Shizuku.
129
My security camera shipped a GitHub admin token in its login page
i dissected some firmware for a Hanwha Wisenet XNP-9300RW and found that it had github admin tokens in it, also miltech is weird
130
Securing Services with Rootless Containers
Some tips to improve security in applications deployed as containers.
131
OpenAI’s accidental attack against Hugging Face is science fiction that happened
This story is wild. The short version: OpenAI were running a cybersecurity test against an unreleased model, with the model’s guardrail features turned off. Rather than solve the test, the …
132
I Inspected My Take-Home Interview Project. It Was a Whole Operation
Appaji, a Computer Science graduate from IIT Patna and former intern at Arista Networks, is a Software Engineer at Infinite Reality. Passionate about building innovative web experiences, with a strong interest in sustainable and customer-focused startups.
133
LG to ban residential proxies from smart TV apps
The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one’s television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG’s…
134
Apple defeats liability for not scanning iCloud for CSAM
This case involves Apple’s handling of user-uploaded files hosted in private iCloud storage. Instead of adopting PhotoDNA to scan hosted files for CSAM, Apple created its own proprietary alternative, NeuralHash, which apparently wasn’t as good. So Apple U-turned on its...
135
GDID Windows – Cut the tracker that follows you even under VPN
The GDID helped catch a hacker despite his VPN. I set up a VM to see if it can be neutralized: what works, what doesn't, and the scripts to stop it from ...
136
My USB Drive Has a Hidden Encrypted Vault
This article was written by a human, for humans. Phantomdrive is now available from the Rootkit Labs shop. Many places don’t respect privacy …
137
Mysteries of Telegram Data Centers (2022)
Telegram claims to have 5 data centers (DCs), referred to as DC1~5 in Telegram’s code and documentation. Among them, DC1 and DC3 are located in Miami, USA; DC2 and DC4 are in Amsterdam, Netherlands; and DC5 is in Singapore. Each account is associated with a DC upon registration and does not change with the…
138
I tricked Claude into leaking your deepest, darkest secrets
How I tricked Claude into leaking your deepest, darkest secrets
139
Probably check on your smart appliances
TL;DR: is your refrigerator running malware? If so, you better catch it!
140
Microsoft has released software updates to plug at least 570 security holes
Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month. Microsoft attributed the burgeoning patch counts to…
141
QuadRF can spot drones and see WiFi through my wall
The QuadRF (pictured above) a phased-array radio built around a Raspberry Pi 5 and an FPGA board with picosecond-level timing. It does advanced signal processing and beamforming. It can see WiFi through walls and track drones in flight. If the open source community can come up with something like this, just imagine…
142
TLS certificates for internal services done right
No self-signing headaches, no TLS erros.
143
EU Parliament greenlights Chat Control 1.0
Today, the European Parliament allowed the suspicionless mass scanning of private communications ("Chat Control 1.0") to pass, a measure it had rejected twice in March. Although a majority of voting Members of the European Parliament (MEPs) actually opposed the regulation (314 against, 276 in favor,
144
Remote Attestation
If it quacks like a duck...
145
Decoding the obfuscated bash script on a Uniqlo t-shirt
IP, technology & commercial law
146
NSA and IETF: Fairness
Secret NSA documents showed that NSA pushed DES in the 1970s to "drive out competitors" while knowing that DES was "weak enough" to break; meanwhile NSA publicly claimed that it would use DES . NSA used export-law exceptions in the 1990s to entrench RC4 and RSA-512, causing security problems for decades . NSA in the…
147
Kernel anti-cheat is an overreach
Modern PC games make you install a ring-0 anti-cheat driver you can't audit.
148
Web-based cryptography is always snake oil
Nowadays, there is an epidemic of web applications purporting to offer “end-to-end” encryption. Examples might range from a file upload service, which allows you to upload and share files of arbitrary size and promises “end-to-end encryption”; or a web-based password safe service which claims that it can't see your…
149
Leaking YouTube creators' private videos
Bug Bounty Hunter & Researcher
150
MSI Center – How to gain SYSTEM privileges in seconds
Abusing named pipes in proprietary software to get LocalSystem privileges in seconds.