1471
Gmail accepts forged YouTube emails
This morning I woke up to an official-looking email from YouTube in my inbox, addressed to an address that isn't mine.
New
The latest blog posts to take off on Hacker News. 4,333 posts.
1472
How to Store an SSH Key on a Yubikey
Xe Iaso's personal website.
1473
Reverse engineering Xiaomi air purifier NFC stickers
For a very thorough write-up on how this all works , please visit : https://unethical.info/2024/01/24/hacking-my-air-purifier/
1474
Windows OS, Services and Apps: Network Connection Target Hosts (2021)
This post lists the internet communication targets of the Microsoft Windows operating system, including its various services and UWP apps. This post is a part of my application network connection monitoring series, a group of articles that explain how to analyze the network traffic of any Windows or macOS app.
1475
1476
A Kernel Hacker Meets Fuchsia OS
Fuchsia is a general-purpose open-source operating system created by Google. It is based on the Zircon microkernel written in C++ and is currently under active development. The developers say that Fuchsia is designed with a focus on security, updatability, and performance. As a Linux kernel hacker, I decided to take a…
1477
Extracting TLS keys from an unwilling application (2020)
I want to be able to inspect the traffic of programs running on my computer. I don’t really trust those programs and ideally I’d like to put nearly all of them into a high security jail. One of those programs is Oculus software. There are a few reasons why I want to be cautious about Oculus software.
1478
Senators Urge FTC to Probe ID.me over Selfie Data
Some of more tech-savvy Democrats in the U.S. Senate are asking the Federal Trade Commission (FTC) to investigate identity-proofing company ID.me for “deceptive statements” the company and its founder allegedly made over how they handle facial recognition data collected on behalf of the Internal Revenue Service …
1479
When Your Smart ID Card Reader Comes With Malware
Millions of U.S. government employees and contractors have been issued a secure smart ID card that enables physical access to buildings and controlled spaces, and provides access to government computer networks and systems at the cardholder’s appropriate security level. But many government employees aren’t issued an…
1480
Stealing checks worth millions and pwning a bank
Another long (hacker) story of mine! Once upon a time contracted to do a penetration test on a bank… I spent the better part of a week assessing every nook and cranny of the main web application. I mapped every function, and every web path, but the main website was very hardened. After spending a lot of time…
1481
Liberating out-of-copyright photos from SmartFrame's DRM
During the middle of the 20th Century, the UK's Royal Air Force took thousands of photographs of the country from above. Think of it like a primitive Google Earth. Those photographs are "Crown Copyright". For photographs created before 1st June 1957, the copyright expires after 50 years. Recently, the organisation…
1482
Own your calendar and contacts with OpenBSD, Baïkal, and FOSS Android
Writer for Semaphore and ButterCMS. Previously Staff Engineer at Deliveroo and in technical leadership at various public sector organisations.
1483
Minnesota Wants to Ban Under-18s from User-Generated Content Services
As part of an omnibus bill, the Minnesota House of Representatives passed a troubling bill restricting how under-18 users engage with user-generated content (UGC) services. [At the bottom of this post, I’ve included the text as passed by the Minnesota...
1484
Chat control: EU Commission presents mass surveillance plan on May 11
Next week on Wednesday (May 11), the EU Commission will present an EU draft law on mandatory chat control to the public for the first time. Similar to Apple's highly controversial "SpyPhone" plans, the Commission wants to oblige all providers of email, chat and messaging services to search for susp
1485
Adding code to an existing ELF file
Recently I was reverse-engineering an Android app [ a ] . The relevant details are as follows:
1486
Scapy: Low level packet hacking toolkit for Python
Code level discussion of web scraping, gray hat automation, growth hacking and bounty hunting
1487
Your phone may soon replace many of your passwords
Apple , Google and Microsoft announced this week they will soon support an approach to authentication that avoids passwords altogether, and instead requires users to merely unlock their smartphones to sign in to websites or online services. Experts say the changes should help defeat many types of phishing attacks and…
1488
1489
Home Made TPM2.0 Module
Introduction With the recent launch of Windows 11 Microsoft also made having a hardware TPM module mandatory. Although this technology is not new (it was introduced in Windows 10 and Windows Server…
1490
1491
What we can deduce from a leaked PDF
Matthew Butterick
1492
You can now ask Google to remove your phone number, email or address from search
Google said this week it is expanding the types of data people can ask to have removed from search results, to include personal contact information like your phone number, email address or physical address. The move comes just months after Google rolled out a new policy enabling people under the age of 18 (or a…
1493
SELinux is unmanageable; just turn it off if it gets in your way
I’ve been an SELinux complexity apologist for years. Lately, I’ve concluded that every implementation with difficult-to-configure policies is just unmanageable.
1494
Reversing a 2.4GHz Remote Control
I have an old project on Github called rf-car for controlling a radio car with HackRF. A few months ago, my daughter received a new RC car made by Dickie Toys :
1495
High-Security Mechanical Locks (2020)
Outside of a very few specialized fields high-security locks are almost totally unknown. Even in the field of locksmithing where high-security locks are known, they are often misunderstood. Today I am going to offer you a primer on the fascinating world of high-security mechanical locks, the securit
1496
Beginners Guide to 0day/CVE AppSec Research
A while ago I took up the challenge to get Offensive Security Web Expert (OSWE) certified. During this journey I learned many awesome things. The most important lesson learned was that with source code and a debugger, I could find vulnerabilities exponentially faster than by using traditional Blackbox/Bug-Bounty…
1497
Extracting WhatsApp Messages from an iOS Backup
Find where WhatsApp chats live in an iPhone backup, decrypt an encrypted iOS backup with Python, and read your messages from ChatStorage.sqlite.
1498
1499
Leaked Chats Show Lapsus$ Stole T-Mobile Source Code
KrebsOnSecurity recently reviewed a copy of the private chat messages between members of the LAPSUS$ cybercrime group in the week leading up to the arrest of its most active members last month. The logs show LAPSUS$ breached T-Mobile multiple times in March, stealing source code for a range of company projects…
1500
I'm a security engineer and I still almost got scammed
I was in the park with my son and his best friend. I saw 2 missed calls from a number I didn’t recognise. I Googled it - it was my bank. I told the other adults that I should call back in case it was important.