301
New
The latest blog posts to take off on Hacker News. 678 posts.
302
Cryptanalysis of Meow Hash
The creators of Meow hash made security claims; we break them all.
303
Google launches new vulnerability reward platform
Posted by Jan Keller, Technical Program Manager, Google VRP A little over 10 years ago , we launched our Vulnerability Rewards Program (VR...
304
The Insecurity Industry
The greatest danger to national security has become the companies claiming to protect it
305
Autofill in password managers can allow login credentials to be stolen
Security Researcher | Ethical Hacker | Web Application Security
306
307
Google results for PHP tutorials contain SQL injection vulnerabilities
Today, out of curiosity, I googled for php mysql email register . This returns tutorials, how-tos, code snippets. Most results include flawed DB statements. This usually means something like
308
Freenom, the free domains website, is a scam
Self-taught developer. Go, Rust, Python and Javascript. - hackermondev
309
Cloudflare's Handling of an RCE Vulnerability in Cdnjs
Recently, a RCE vulnerability in the way cdnjs’ backend is automatically keeping web resources up to date has been disclosed. Read about how Cloudflare handled the security incident and what will prevent similar exploits in the future.
310
HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10
This is the story of how all non-admin users can read the registry — and so elevate privileges and access sensitive credential information…
311
Bringing supply chain security features to the Go community
GitHub’s supply chain security features are now available for Go modules, which will help the Go community discover, report & prevent vulnerabilities.
312
How to exfiltrate code from Bitbucket
Every year or so, something compels me to start over with a fresh OS image. Most recently, that something was an unfortunate water bottle incident. Once again, I need to pull down my digital life from the internet. The code and assets for this blog currently live in a 500 MB Git repository, which was hosted on…
313
314
Serial swatter who caused death gets five years in prison
A 18-year-old Tennessee man who helped set in motion a fraudulent distress call to police that led to the death of a 60-year-old grandfather in 2020 was sentenced to 60 months in prison today.
315
NSO Group Hacked
NSO Group, the Israeli cyberweapons arms manufacturer behind the Pegasus spyware—used by authoritarian regimes around the world to spy on dissidents, journalists, human rights workers, and others—was hacked. Or, at least, an enormous trove of documents was leaked to journalists. There’s a lot to read out there…
316
A case against security nihilism
This week a group of global newspapers is running a series of articles detailing abuses of NSO Group’s Pegasus spyware. If you haven’t seen any of these articles, they’re worth re…
317
Stopping FTP support in Firefox 90
The File Transfer Protocol (FTP) has long been a convenient file exchange mechanism between computers on a network. While this standard protocol has been supported in all major browsers ...
318
Don’t Wanna Pay Ransom Gangs? Test Your Backups
Browse the comments on virtually any story about a ransomware attack and you will almost surely encounter the view that the victim organization could have avoided paying their extortionists if only they’d had proper data backups. But the ugly truth is there are many non-obvious reasons why victims end up paying even…
319
Forensic Methodology Report: How to catch NSO Group’s Pegasus
NSO Group claims that its Pegasus spyware is only used to “investigate terrorism and crime” and “leaves no traces whatsoever”. This Forensic Methodology Report shows that neither of these statements are true. This report accompanies the release of the Pegasus Project, a collaborative investigation that involves more…
320
The new ProtonMail has passed its independent security audit
Before we released the new Proton Mail, security experts conducted an independent audit of its open source code. You can read their report.
321
Hooking Candiru: Another mercenary spyware vendor comes into focus
Candiru is a secretive Israel-based company that sells spyware exclusively to governments. Using Internet scanning, we identified more than 750 websites linked to Candiru’s spyware infrastructure. We found many domains masquerading as advocacy organizations such as Amnesty International, the Black Lives Matter…
322
Mitmproxy 7.0
We’re delighted to announce the release of mitmproxy 7, a free and open source interactive HTTPS proxy. This release is all about our new proxy core, which bring substantial improvements across the board and represents a massive milestone for the project.
323
Remote code execution in cdnjs of Cloudflare
Preface (日本語版も公開されています。) Cloudflare, which runs cdnjs, is running a “Vulnerability Disclosure Program” on HackerOne, which allows hackers to perform vulnerability assessments. This article describes vulnerabilities reported through this program and published with the permission of the Cloudflare security team. So this…
324
Online ID / age verification: the death of online search
Neil note: I’ve published this with the hope that others familiar with what this could entail will give feedback. As such, what you read now might not be the final version. If I make material changes, I’ll indicate them.
325
Analyzing the legal implications of GitHub Copilot
Explore the potential legal challenges GitHub Copilot faces regarding copyright infringement and license compliance of its code suggestions.
326
Building a Curve25519 Hardware Accelerator
Note: this post uses a $\LaTeX$ plugin to render math symbols. It may require a desktop browser for the full experience…
327
CVE-2021-22555: Turning \x00\x00 into 10000$
This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.
328
Increasing HTTPS Adoption
When a browser connects to websites over HTTPS (vs. HTTP), eavesdroppers and attackers on the network can't intercept or alter the data that...
329
EU legislation allows emails, messages and other communications to be scanned
On 6 July, the European Parliament adopted in a final vote the derogation to the main piece of EU legislation protecting privacy, the ePrivacy Directive, to allow Big Tech to scan your emails, messages and other online communications.
330
Firefox 90 supports Fetch Metadata Request Headers
We are pleased to announce that Firefox 90 will support Fetch Metadata Request Headers which allows web applications to protect themselves and their users against various cross-origin threats like ...