1
Déjà vu: Ghostly CVEs in my terminal title
As I've spoken and written about all modern terminals are actually "emulating" something dating from the 1970s.
New
The latest blog posts to take off on Hacker News. 279 posts.
2
U.S. Army Soldier Arrested in AT&T, Verizon Extortions
Federal authorities have arrested and indicted a 20-year-old U.S. Army soldier on suspicion of being Kiberphant0m , a cybercriminal who has been selling and leaking sensitive customer call records stolen earlier this year from AT&T and Verizon . As first reported by KrebsOnSecurity last month, the accused is a…
3
Dumping Memory to Bypass BitLocker on Windows 11
Memory-Dump-UEFI is a UEFI application for dumping the contents of RAM.
4
Personal Mail Server on OpenBSD (2019)
I will use this place to relate my geeky adventures in the world of gnu/linux, bsd, the internets, and other important things like windows managers and pretty colors. Basically, it's a place to expose and share with the world things I do on my computer.
5
Finding and exploiting hidden features of Animal Crossing's NES emulator (2018)
While looking for ways to activate the developer menus left over in Animal Crossing, including the NES emulator game selection menu, I found an interesting feature that exists in the original game that was always active, but never used by Nintendo. In addition to the NES/Famicom games that can be obtained in-game, it…
6
Why it's hard to trust software, but you mostly have to anyway
My long-time collaborator Richard Barnes [1] used to say that "in security, trust is a four letter word" , and yet the dominant experience of using any software-based system—which is, you know, pretty much anything electronic—is trusting the manufacturer. Not only is there no meaningful way to determine what software…
7
Apple Photos phones home on iOS 18 and macOS 15
This morning while perusing the settings of a bunch of apps on my iPhone, I discovered a new setting for Photos that was enabled by default: Enhanced Visual Search. (I manually disabled it before taking the screenshot below.)
8
How to Create HTML/ZIP/PNG Polyglot Files
Learn How to Create HTML/ZIP/PNG Polyglot Files!
9
Narrative Jailbreaking for Fun and Profit
Posted on Monday 23 Dec 2024. 1,634 words, 1 link. By Matt Webb.
10
11
Exploiting McDonald's APIs to hijack deliveries and order food for a penny
A series of API flaws in McDelivery India made it possible to order food for a penny, hijack other people’s delivery orders, view user information, and more.
12
How to lose a fortune with one bad click
Adam Griffin is still in disbelief over how quickly he was robbed of nearly $500,000 in cryptocurrencies. A scammer called using a real Google phone number to warn his Gmail account was being hacked, sent email security alerts directly from google.com, and ultimately seized control over the account by convincing him…
13
14
Converting untrusted PDFs into trusted ones: The Qubes Way (2013)
Arguably one of the biggest challenges for desktop security is how to handle those overly complex PDFs, DOCs, and similar files, that are so often exchange...
15
16
0x01 – Killing Windows Kernel Mitigations
This post was made possible through hard work and determination. Do not feel frustrated if this stuff does not click immediately and remember, the source of truth will always be the source code. For us, our source code is raw assembly. That said it’s important you understand these techniques in detail because when…
17
Phishers Love New TLDs Like .shop, .top and .xyz
Phishing attacks increased nearly 40 percent in the year ending August 2024, with much of that growth concentrated at a small number of new generic top-level domains (gTLDs) — such as .shop , .top , .xyz — that attract scammers with rock-bottom prices and no meaningful registration requirements, new research finds…
18
Breaking the 4Chan CAPTCHA
In this blog post, I will talk about my successful experiment in machine learning using TensorFlow to automate solving the 4Chan CAPTCHA.
19
Emacs arbitrary code execution and how to avoid it
A post by Eshel Yaron with details and advice about a long standing arbitrary code execution vulnerability in Emacs
20
Hacker in Snowflake extortions may be a U.S. soldier
Two men have been arrested for allegedly stealing data from and extorting dozens of companies that used the cloud data storage company Snowflake , but a third suspect — a prolific hacker known as Kiberphant0m — remains at large and continues to publicly extort victims. However, this person’s identity may not remain a…
21
RFC 35140: HTTP Do-Not-Stab (2023)
Date: March 7, 2111
22
WireGuard: Beyond the most basic configuration
Last week I wanted to replace my OpenVPN setup with WireGuard. The basics were well-documented, going beyond the basics was a bit trickier. Let me teach you want I learned. The basics But first, let’s summarize the basics. I have a server with a hosting provider that I want to use as a VPN server. I won’t delve into…
23
TIL: Some surprising code execution sources in bash
I ran across two surprising sources of code execution in bash (and probably other shells) recently.
24
Handling cookies is a minefield
Discrepancies in how browsers and libraries handle HTTP cookies, and the problems caused by such things.
25
26
Reverse Engineering iOS 18 Inactivity Reboot
Wireless and firmware hacking, PhD life, Technology
27
I Followed the Official AWS Amplify Guide and Was Charged $1,100
An interesting thing happens when you follow the official Amplify guide.
28
Bypassing regulatory locks, hacking AirPods and Faraday cages
How we bypassed Apple's regulatory restrictions, built a Faraday cage and enabled georestricted features on the Airpods Pro 2 for our grandparents.
29
Security Is a Useless Controls Problem
We're all a bunch of chimps in a cage
30
OpenID Connect specifications published as ISO standards
I’m thrilled to report that the OpenID Connect specifications have now been published as ISO/IEC standards. They are: