3211
Faking a Positive Covid Test
True cyber security combines advanced technology and best practice. Get tips and read articles on how to take your online security even further.
New
The latest blog posts to take off on Hacker News. 8,771 posts.
3212
The Belgian government has removed ‘backdoor requirement’ from new law
The Belgian government has removed 'backdoor requirement' from new law after international protest.
3213
China issues new encryption import control
On November 2, 2021, Ministry of Commerce of China (“MOFCOM”) officially released the revised Catalogue of Technologies Subject to Import Prohibition and Restriction (“Technology Catalogue”), effective immediately, which identifies, among others, foreign “data encryption technology employing a key length greater than…
3214
RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
The Visual Studio Code server in Windows Subsystem for Linux uses a local WebSocket WebSocket connection to communicate with the Remote WSL extension. JavaScript in websites can connect to this server and execute arbitrary commands on the target system. Assigned CVE-2021-43907 and zero bounty. I paid 5 USD for the EC2…
3215
Inverting PhotoDNA
Ribosome inverts Microsoft PhotoDNA hashes using machine learning.
3216
New EU data blockage as German court would ban many cookie management providers
Alston & Bird’s Dan Felz and Peter Swire look at the recent Wiesbaden Administrative Cou
3217
An iframe from googlesyndication.com tries to access the camera and microphone
The last thing we want is for an advertising network to access the Camera or Microphone on our computer. But, while looking for something else, I stumbled upon messages in the Safari JavaScript console saying that an iframe loaded from safeframe.googlesyndication.com tried to do exactly that.
3218
3219
A deep dive on a Facebook reseller of bikes stolen in Colorado
Bike Index tracks a Colorado-to-Mexico stolen bike pipeline - and learns things along the way
3220
Third High Severity CVE in Log4j Is Published
The Logging Services Security Team takes security seriously. This allows our users to place their trust in Log4j for protecting their mission-critical data. On this page, we will help you find guidance on security-related issues and access to known vulnerabilities.
3221
CCPA Scam – Human subject research study conducted by Princeton University
Get ready for the CCPA compliance scams from Princeton.
3222
Pegasus vs. Predator
Two Egyptians—exiled politician Ayman Nour and the host of a popular news program (who wishes to remain anonymous)—were hacked with Predator spyware, built and sold by the previously little-known mercenary spyware developer Cytrox. The phone of Ayman Nour was simultaneously infected with both Cytrox’s Predator and NSO…
3223
NY Man Pleads Guilty in $20M SIM Swap Theft
A 24-year-old New York man who bragged about helping to steal more than $20 million worth of cryptocurrency from a technology executive has pleaded guilty to conspiracy to commit wire fraud. Nicholas Truglia was part of a group alleged to have stolen more than $100 million from cryptocurrency investors using…
3224
Cryptocurrency scams cost owners $7.7B in 2021, driven by DeFi-based “rug pulls”
Crypto scams were once again the largest form of crypto crime, with over $7.7 billion worth of cryptocurrency taken from victims worldwide.
3225
Clever uses of pass, the Unix password manager
Pass ( main site , Arch wiki ) is a command-line Unix password manager that utilizes GPG for all underlying encryption. However, beyond passwords, we can utilize it in a number of clever ways.
3226
Log4j 2.15.0 – Previously suggested mitigations may not be enough
Log4j 2.15.0 and previously suggested mitigations may not be enough, Author: Renato Marinho
3227
Crypto wallet security as seen by security engineers
How to build secure crypto wallets, analysing issues found during crypto wallet security audits.
3228
Preventing Pool-Party Attacks
Brave has identified a new category of tracking vulnerability, forms of which are present in all browsers. We call this category of attack “pool-party” attacks because the attack uses collections (or “pools”) of limited-but-shared resources to create side channels.
3229
A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen Lab ...
3230
3231
Hex-rays is moving to a subscription model
Hex-Rays is moving to a subscription model In 2022, we will update the catalogue of products available under our subscription model. Our new bundles are
3232
3233
3234
Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide
Summary of CVE-2021-4228 (Log4Shell), trivial RCE in log4j, a common Java logging framework. Includes list of affected platforms.
3235
Vivaldi: Violating CoC on forum may close your email account
We’re building a Community that is happy, kind, and constructive. Read our Code of Conduct for and find out how you can help us get there.
3236
Managed by Bots: surveillance of gig economy workers
What if your boss was an algorithm? What would you do if your employer suddenly fired you or reduced your pay without telling you why? And without being willing to give you a reason when you ask for one?
3237
3238
Log4j: Between a rock and a hard place
There is more than enough written on the mechanics of and mitigations for the recent severe RCE in log4j . On prevention, this is the most interesting widely-reshared insight I have seen:
3239
Widespread exploitation of critical remote code execution in Apache Log4j
On December 10, 2021, Apache released a fix for CVE-2021-44228, a critical RCE vulnerability affecting Log4j that is being exploited in the wild.
3240
