2191
A 96 Bitcoin ransom payment ends up on Bitfinex
"Hello, to get your data back you have to pay for the decryption tool, the price is $1,200,000... You have to make the payment in Bitcoin...
New
The latest blog posts to take off on Hacker News. 4,335 posts.
2192
Does Your Domain Have a Registry Lock?
If you’re running a business online, few things can be as disruptive or destructive to your brand as someone stealing your company’s domain name and doing whatever they wish with it. Even so, most major Web site owners aren’t taking full advantage of the security tools available to protect their domains from being…
2193
Banning facial recognition is missing the point
Spanish translation Communities across the United States are starting to ban facial recognition technologies. In May of last year, San Francisco banned facial recognition; the neighboring city of Oakland soon followed, as did Somerville and Brookline in Massachusetts (a statewide ban may follow). In December, San…
2194
Stop donating your customers' data to Google Analytics
In 2020, with better alternatives available, using Google Analytics (GA) to track your web usage is n...
2195
Cloudflare is turning off the internet for me
A classically trained sysadmin shouting into the void.
2196
What to do if you’re stopped by the police
When I was 5, I saw the Karate Kid. I saw that bad guys could beat me up, and I had no recourse if I didn't know karate. I promptly signed up for martial arts classes.
2197
Cryptic Rumblings Ahead of First 2020 Patch Tuesday
Sources tell KrebsOnSecurity that Microsoft Corp. is slated to release a software update on Tuesday to fix an extraordinarily serious security vulnerability in a core cryptographic component present in all versions of Windows . Those sources say Microsoft has quietly shipped a patch for the bug to branches of the U.S…
2198
Why I Quit Using Google
So I was recently asked why I prefer to use free and open source software over more conventional and popular proprietary software and services. A few years ago I was an avid Google user. I was deep…
2199
I opened a link some random person sent me and I got raided (2015)
Personal Blog of Christian Haschek
2200
A Hidden Cost of Ransomware: Wholesale Password Theft
Organizations in the throes of cleaning up after a ransomware outbreak typically will change passwords for all user accounts that have access to any email systems, servers and desktop workstations within their network. But all too often, ransomware victims fail to grasp that the crooks behind these attacks can and…
2201
Always Review Your Dependencies, AGPL Edition
Before adding a dependency to one of my software projects, I do some basic vetting of the dependency. Among the things I check are:
2202
Promiscuous cookies and their impending death via the SameSite policy
Cookies like to get around. They have no scruples about where they go save for some basic constraints relating to the origin from which they were set. I mean have a think about it: If a website sets a cookie then you click a link to another page on that
2203
Microsoft Edge (Chromium) – Elevation of Privilege to Potential RCE
With some luck and a couple of XSS bugs I was able to break the new Edge
2204
Scammers registering date-based domain names
Yesterday, January 2nd, my wife received a billing alert from her phone provider. Luckily, she's not with EE - because it's a pretty convincing text. That domain name is specifically designed to include the day's date. If you're stood up on a crowded train, with your phone screen cracked, would you notice that a . is…
2205
BusKill: A kill cord for your laptop
BusKill is a Kill Cord for your laptop implementing a Dead Man Switch using $20 in USB hardware + udev rule to trigger your laptop self-destruct if stolen.
2206
One Year After ‘The Big Hack’
Today marks the one-year anniversary of Bloomberg’s publication of a story about Chinese intelligence intercepting the supply chain of Supermicro, a company which has built and sold servers to Amazon, Apple, the U.S. Department of Defense, and dozens of other companies. Apparently, they developed a chip that looked…
2207
2208
Flight stats, entertainment, and trying to crack Widevine
Investigating onboard flight entertainment APIs, flight telemetry, and Widevine-protected media.
2209
NSA's Backdoor Key from Lotus Notes (2002)
Before the US crypto export regulations were finally disolved the export version of Lotus Notes used to include a key escrow / backdoor feature called differential cryptography. The idea was that they got permission to export 64 bit crypto if 24 of those bits were encrypted for the NSA's public key. The NSA would then…
2210
Use GitHub actions at your own risk
Malicious code can be inserted into any GitHub action, even those which are tagged.
2211
2212
Ransomware gangs now outing victim businesses that don't pay
As if the scourge of ransomware wasn’t bad enough already: Several prominent purveyors of ransomware have signaled they plan to start publishing data stolen from victims who refuse to pay up. To make matters worse, one ransomware gang has now created a public Web site identifying recent victim companies that have…
2213
Still Why No HTTPS?
Back in July last year, Scott Helme and I shipped a little pet project that tracked the world's largest websites not implementing HTTPS by default [https://www.troyhunt.com/why-no-https-heres-the-worlds-largest-websites-not-redirecting-insecure-requests/] . We called it Why No HTTPS? [https://whynohttps.
2214
#include </etc/shadow>
This blog is written by Hanno Böck. Unless noted otherwise, its content is licensed as CC0 .
2215
‘Evil Corp,’ a $100M Cybercrime Menace
The U.S. Justice Department this month offered a $5 million bounty for information leading to the arrest and conviction of a Russian man indicted for allegedly orchestrating a vast, international cybercrime network that called itself “ Evil Corp ” and stole roughly $100 million from businesses and consumers. As it…
2216
49% of workers, forced to change passwords, reuse same one with minor change
A new survey has revealed some alarming news about the way users are choosing their passwords in their homes and workplace.
2217
Learning from OpenBSD can make computers marginally less horrible
telegra.ph/why-openbsd-is-marginally-less-horrible-12-052019220 points127 commentsSystems & Performance details
The following document is an attempt to consolidate down a number of threads spanning separate discussions from around the 'net I have been having on the subject of operating system development models and OpenBSD. I will break up this document into several sections each of which will handle separate pillars of my…
2218
Warrantless encryption is a first amendment issue
Encryption is privacy incarnate – don’t ban it
2219
Scaring People into Supporting Backdoors
Back in 1998, Tim May warned us of the “Four Horsemen of the Infocalypse”: “terrorists, pedophiles, drug dealers, and money launderers.” I tended to cast it slightly differently. This is me from 2005: Beware the Four Horsemen of the Information Apocalypse: terrorists, drug dealers, kidnappers, and child pornographers…
2220
The Great $50M African IP Address Heist
A top executive at the nonprofit entity responsible for doling out chunks of Internet addresses to businesses and other organizations in Africa has resigned his post following accusations that he secretly operated several companies which sold tens of millions of dollars worth of the increasingly scarce resource to…