1921
Double Blind Passwords a.k.a. Horcruxing
Before we get into Horcruxing, here's a quick prologue on online security hygiene. You can skip to the Horcruxing section if it seems redundant. 1. Longer…
New
The latest blog posts to take off on Hacker News. 4,335 posts.
1922
Understanding how AES encryption works
Deepen your understanding of AES implementation using golang.
1923
Windows 10 20H2: ChkDsk damages filesystem on SSDs with KB4592438 installed
[German]In Windows 10 20H2 with installed cumulative update KB4592438, chkdsk causes massive issues. It destroys the file system during a disk check on SSDs, so Windows 10 can’t start after a reboot.
1924
Virtual Machine Detection in the Browser (2019)
Virtual Machine (VM) detection is nothing new. Malware has been doing it for over a decade now. Over time the techniques have advanced as defenders learned new ways of avoiding VM detection. A while back a friend and I were working on a project related to exploit delivery via a web application for redteaming purposes…
1925
Facebook's Hypocrisy on Apple's New iOS 14 Privacy Feature
In their latest attempt to disrupt the iOS anti-ad tracking feature, Facebook has stooped to a new low
1926
TP-Link Archer VR1600V V2 Super User Password Cracked
Well the news is out, I won’t explain the method for reasons, but our code warriors have a new fight. After requesting the SU password, they were told flat out it doesn’t exist and refe…
1927
Should There Be Limits on Persuasive Technologies?
Persuasion is as old as our species. Both democracy and the market economy depend on it. Politicians persuade citizens to vote for them, or to support different policy positions. Businesses persuade consumers to buy their products or services. We all persuade our friends to accept our choice of restaurant, movie, and…
1928
The cleverest floppy disc protection ever? Western Security Ltd
Introduction I've been on a bit of a floppy disc protection odyssey recently. This will probably be the last floppy disc related post for so...
1929
U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise
Communications at the U.S. Treasury and Commerce Departments were reportedly compromised by a supply chain attack on SolarWinds , a security vendor that helps the federal government and a range of Fortune 500 companies monitor the health of their IT networks. Given the breadth of the company’s customer base, experts…
1930
Privacy matters even if “you have nothing to hide”
Self-hosted and privacy-respecting blog software that puts the domain, data, and reader relationship back in your hands. Private alternatives to Medium, vetted since 2015.
1931
I Hacked into Facebook's Legal Department Admin Panel
Alaa Abdulridha — Engineering Director at SerpApi & Cybersecurity Researcher. Expert in web application penetration testing, reverse engineering, bug bounty programs, and secure code development. Passionate about discovering vulnerabilities, building scalable systems, and teaching practical cybersecurity techniques.
1932
Anti-fingerprinting extensions tend to make fingerprinting easier
Browser extensions claiming to protect against fingerprinting will typically result in more data available for fingerprinting.
1933
1934
Macs with T2, M1 chips cannot be restored to factory state without Apple
Modern Apple computers can no longer be fully used and maintained in 100% offline environments, or in ways that will reasonably ensure that the computer is…
1935
InstaHide Disappointingly Wins Bell Labs Prize, 2nd Place
[What follows are my thoughts on some recent research in machine learning privacy. These are my thoughts, and do not represent those of others.]
1936
How does Brown University know where you are?
In September 2020, Brown University accused students of lying about their location; e.g.:
1937
72% of smart TVs and 46% of game consoles hardcode DNS settings
Welcome Hacker News readers!• Thank you to M. Hammad Mazhar for his research that inspired this guide.• @healyio made some great additional suggestions in th...
1938
I accidentally built a spying app
A personal story about creating new products and their unintended consequences
1939
Linux kernel heap quarantine versus use-after-free exploits
It's 2020. Quarantines are everywhere – and here I'm writing about one, too. But this quarantine is of a different kind. In this article I'll describe the Linux Kernel Heap Quarantine that I developed for mitigating kernel use-after-free exploitation.
1940
Yet another macOS privacy protections bypass
Today I'm disclosing a macOS privacy protections bypass. I discovered that an application can use the venerable Unix command-line tool "ls" (list directory contents) to bypass both TCC (Transparency, Consent, and Control) and the sandbox, enabling unauthorized access to file metadata in directories that are supposed…
1941
GPG and Me (2015)
I receive a fair amount of email from strangers. My email address is public, which doesn’t seemto be a popular choice these days, but I’ve received enough inspiring correspondence over the yearsto leave it be.When I receive a GPG encrypted email from a stranger, though, I immediately get the fee...
1942
CAPTCHAs don’t prove you’re human – they prove you’re American (2017)
When I was a small child, I took an IQ test. One of the first questions I stumbled on was "A piece of candy costs 25¢. Jonny has a dime. How many nickels does he need to buy the candy?" My 7-year old brain popped. WTAF is a nickel? Or a dime for that matter? We don't have those coins in my country! We don't spend in ¢…
1943
macOS has checked app signatures online for over 2 years
Why does it take 2 years to realise that macOS has been checking signing certificate validity online?
1944
How Rainbow Tables Work
I found the creator of Rainbow Table's paper, aimed at cryptanalysts, was pretty inaccessible considering the simplicity and elegance of Rainbow Tables, so this is an overview of it for a layman.
1945
Android | Madaidan's Insecurities
By default, Android has a strong security model and incorporates full system SELinux policies , strong app sandboxing , full verified boot , modern exploit mitigations like fine-grained, forward-edge Control Flow Integrity and ShadowCallStack , widespread use of memory-safe languages (Java / Kotlin) and more. As such…
1946
Another free CA as an alternative to Let's Encrypt
Let's Encrypt is an amazing organisation doing an amazing thing by providing certificates at scale, for free. The problem though was that they were the only such organisation for a long time, but I'm glad to say that the ecosystem is changing. It's always a good idea
1947
GoDaddy employees used in attacks on multiple cryptocurrency services
Fraudsters redirected email and web traffic destined for several cryptocurrency trading platforms over the past week. The attacks were facilitated by scams targeting employees at GoDaddy , the world’s largest domain name registrar, KrebsOnSecurity has learned.
1948
Ok Google: please publish your DKIM secret keys
The Internet is a dangerous place in the best of times. Sometimes Internet engineers find ways to mitigate the worst of these threats, and sometimes they fail. Every now and then, however, a major …
1949
Does Apple really log every app you run? A technical look
Apple’s launch of macOS Big Sur was almost immediately followed by server issues which prevented users from running third-party apps on their computers. While a workaround was soon found by people on Twitter, others raised some privacy concerns related to that issue.
1950
Application trust is hard, but Apple does it well
On November 12, 2020 Apple released macOS Big Sur. In the hours after the release went live, somewhere in Apple's infrastructure an OCSP esponder cried out in pain…