1651
Faking Twitter unfurling to phish you
Do you trust links? Well, you shouldn’t. Do you trust this link: Twitter says this link should take you to Uniswap, nobody would be none-the-wiser because we…
New
The latest blog posts to take off on Hacker News. 4,333 posts.
1652
‘Trojan Source’ Bug Threatens the Security of All Code
Virtually all compilers — programs that transform human-readable source code into computer-executable machine code — are vulnerable to an insidious attack in which an adversary can introduce targeted vulnerabilities into any software without being detected, new research released today warns. The vulnerability…
1653
EBCDIC is incompatible with GDPR
Welcome to acronym city! The Court of Appeal of Brussels has made an interesting ruling. A customer complained that their bank was spelling the customer's name incorrectly. The bank didn't have support for diacritical marks. Things like á, è, ô, ü, ç etc. Those accents are common in many languages. So it was a little…
1654
Microsoft no longer signs Windows drivers for Process Hacker
[German]Brief information, which is already here with me since August 2021, but which I have not yet addressed in the blog. David Xanatos has pointed out to me that Microsoft is refusing to sign…
1655
1656
1657
Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting
On Wednesday, the St. Louis Post-Dispatch ran a story about how its staff discovered and reported a security vulnerability in a Missouri state education website that exposed the Social Security numbers of 100,000 elementary and secondary teachers. In a press conference this morning, Missouri Gov. Mike Parson (R) said…
1658
How to win at CORS
The 'how' and 'why' of CORS, from start to finish.
1659
IoT hacking and rickrolling my high school district
This is the story of how I created a botnet of IPTVs to rickroll 10,000+ students for my senior prank.
1660
The Microsoft MFA system almost brought me to a nervous breakdown
Update 12/10/21, 10:15 UTC: I never imagined this post would reach the front page on Hacker News and gather so much support. Thank you all…
1661
Hacking YouTube with a MP4
Keyboard Warrior, Breaking software is just finding unintended features, right?
1662
European Parliament Voted to Ban Remote Biometric Surveillance
It’s not actually banned in the EU yet—the legislative process is much more complicated than that—but it’s a step: a total ban on biometric mass surveillance. To respect “privacy and human dignity,” MEPs said that EU lawmakers should pass a permanent ban on the automated recognition of individuals in public spaces…
1663
Malwarebytes' privacy VPN is Mullvad in a shady trenchcoat
Personal blog of Julien (jvoisin) Voisin
1664
Incenser, or how NSA and GCHQ are tapping internet cables (2014)
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
1665
What Happened to Facebook, Instagram, and WhatsApp?
Facebook and its sister properties Instagram and WhatsApp are suffering from ongoing, global outages. We don’t yet know why this happened, but the how is clear: Earlier this morning, something inside Facebook caused the company to revoke key digital records that tell computers and other Internet-enabled devices how to…
1666
The Rise of One-Time Password Interception Bots
In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords (OTPs) that many websites require as a second authentication factor in addition to passwords. That service quickly went offline, but new research reveals a number of competitors have since…
1667
Always-on Processor magic: How Find My works while iPhone is powered off
Wireless and firmware hacking, PhD life, Technology
1668
Apple AirTag Bug Enables ‘Good Samaritan’ Attack
The new $30 AirTag tracking device from Apple has a feature that allows anyone who finds one of these tiny location beacons to scan it with a mobile phone and discover its owner’s phone number if the AirTag has been set to lost mode. But according to new research, this same feature can be abused to redirect the Good…
1669
1670
DoS attacks against my online game
DDraceNetwork is an open source online game I’ve been running since 2013 with a community of volunteers. The game is available for free, I’m hosting servers for it in many countries around the world so that we have trusted official ranks . The servers are paid for by donations , which I stop collecting once the cost…
1671
1672
Your face is not a bar code: arguments against automatic face recognition (2001)
An abridged version of this article appeared in Whole Earth 106, Winter 2001, pages 74-77.
1673
Authenticated Boot and Disk Encryption on Linux
Posts and writings by Lennart Poettering
1674
1675
1676
Let's Encrypt's old root certificate is expiring
On 30th September 2021, the root certificate that Let's Encrypt are currently using, the IdentTrust DST Root CA X3 certificate, will expire. You may or may not need to do anything about this Root CA expiring, but I'm betting a few things will probably break on that day
1677
Imaging mounted disk volumes under duress
Backups are critical. If you are lucky and organised you have a set of useful backup primitives, such as Point in Time snapshots on your Infrastructure As A Service (IaaS), your disk array controller, or volume manager. However there always seems to be some critical machine in my life that does not fall into these…
1678
The pitfalls of using SSH-agent, or how to use an agent safely
Unfortunately for you, we promised a follow up to talk about the security implications of using such an agent. So, here we are.
1679
Alexa leaks private wishlists
This morning, my wife noticed that Alexa was insistently flashing its little blue lights. "Alexa... Notifications?" "You have one notification. An item on your wishlist has dropped in price. The … is now only £…" And that's how my wife found out what I planned to get her for her birthday! What happened to cause this?…
1680
You don't need to burn off your fingertips (and other biometric myths)
111 years ago almost to the day, a murder was committed which ultimately led to the first criminal trial to use fingerprints as evidence [https://www.smithsonianmag.com/history/first-case-where-fingerprints-were-used-evidence-180970883/] . We've all since watched enough crime shows to understand that fingerprints are