1771
New
The latest blog posts to take off on Hacker News. 4,334 posts.
1772
What's in email tracking links and pixels?
This investigation into email tracking attempts to deconstruct tracking links and pixels and highlight the data that is being collected. It covers Mailchimp, …
1773
Microsoft Patches Six Zero-Day Security Holes
Microsoft today released another round of security updates for Windows operating systems and supported software, including fixes for six zero-day bugs that malicious hackers already are exploiting in active attacks.
1774
1775
The top-ranking HTML editor on Google is an SEO scam
I went down a rabbit-hole analysing a competitor and discovered a black-hat SEO operation involving tens of thousands of websites.
1776
Password Managers
I’ve spent a lot of time trying to understand the attack surface of popular password managers. I think I’ve spent more time analyzing them than practically anybody else, and I think that qualifies me to have an opinion!
1777
How I Learned Symmetric-Key Cryptanalysis
personal web-log
1778
Valid Signal privacy issues shrugged off while patches quietly rolled out
kelly kaoudis: application security, hacking, software engineering blog
1779
Aaron Swartz, Vindicated
Almost without exception, people who invest in businesses do so without personally inspecting the business, overlooking its processes, seeing its bank statements, meeting its managers and going on the road with its sales-force.
1780
Google Joins Apple to Opt-out of Mobile Advertising IDs
Android 12 makes interest-based advertising obsolete to set off an irreversible collapse in Facebook’s ad ecosystem
1781
1782
How Not to Redact a Warhead
How the wrong settings on a photocopier has let us have a glimpse at a forbidden image of a modern thermonuclear warhead.
1783
1784
Using fake reviews to find dangerous extensions
Fake, positive reviews have infiltrated nearly every corner of life online these days, confusing consumers while offering an unwelcome advantage to fraudsters and sub-par products everywhere. Happily, identifying and tracking these fake reviewer accounts is often the easiest way to spot scams. Here’s the story of how…
1785
Pwned passwords, open source in the .NET foundation and working with the FBI
I've got 2 massive things to announce today that have been a long time in the works and by pure coincidence, have aligned such that I can share them together here today. One you would have been waiting for and one totally out of left field. Both these announcements
1786
How to Tell a Job Offer from an ID Theft Trap
One of the oldest scams around — the fake job interview that seeks only to harvest your personal and financial data — is on the rise, the FBI warns. Here’s the story of a recent LinkedIn impersonation scam that led to more than 100 people getting duped, and one almost-victim who decided the job offer was…
1787
SimpleVisor – Intel VT-x hypervisor in 500 lines of C code
Simplevisor : SimpleVisor is a simple, portable, Intel VT-x hypervisor with two specific goals: using the least amount of assembly code (10 lines), and having the smallest amount of VMX-related code to support dynamic hyperjacking and unhyperjacking (that is, virtualizing the host state from within the host). It runs…
1788
Identify a Facebook user by his phone number despite privacy settings set
The goal of this blog is to share write-ups about bugs i have found in Facebook and reported to them under the Facebook bug bounty program.
1789
Try This One Weird Trick Russian Hackers Hate
In a Twitter discussion last week on ransomware attacks, KrebsOnSecurity noted that virtually all ransomware strains have a built-in failsafe designed to cover the backsides of the malware purveyors: They simply will not install on a Microsoft Windows computer that already has one of many types of virtual keyboards…
1790
DarkSide ransomware gang quits after servers, Bitcoin stash seized
The DarkSide ransomware affiliate program responsible for the six-day outage at Colonial Pipeline this week that led to fuel shortages and price spikes across the country is running for the hills. The crime gang announced it was closing up shop after its servers were seized and someone drained the cryptocurrency from…
1791
Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea
Disclaimer: Thoughts expressed here are my own, and not of my employers.
1792
JWT should not be your default for sessions
When designing web applications, (especially the traditional HTML kind), you will at one point have to figure out how to log a user in and keep them logged in between requests.
1793
I could send any text message from Indian government IDs
Sometimes, you don’t necessarily need to hack a system to exploit it.
1794
1795
Tracking One Year of Malicious Tor Exit Relay Activities (Part II)
>25% of the Tor network’s exit capacity has been attacking Tor users
1796
Using GDPR to obtain one’s data as JSON
TL;DR: If you live in the EU or are a EU citizen, companies must provide personal data you provided or they collected in a machine-readable format, following the article 20 of the GDPR.
1797
Apple Silicon Hardware: SPRR and Guarded Exception Levels (GXF)
Over a year ago siguza published a write-up about Apple’s APRR - a custom ARM extension that redefines pagetable permissions and protects certain parts of the kernel from itself. Since then Apple has released their M1 chip which not only features an updated version of APRR but also easily allows to run bare-metal code…
1798
Hardening macOS (2018)
Quick and easy guide for securing macOS systems, for both laymen and security enthusiasts. Last updated for Golden Gate.
1799
I Hacked Google App Engine: Anatomy of a Java Bytecode Exploit
Back in college, I was very interested in Java bytecode. When I got an internship at Google in 2013, I was skeptical of the security of the Java version of Google App Engine and got permission to spend the last week of my internship doing a mini red team exercise, trying to break into App Engine. This is the story of…
1800
Why What3Words is not suitable for safety critical applications
What3Words is a widely promoted system that is used for sharing a location using just three words. For example, ///wedge.drill.mess is located in Hyde Park.The globe is divided into 3m squares, eac…