3301
New
The latest blog posts to take off on Hacker News. 8,771 posts.
3302
Proposed illegal image detectors on devices are ‘easily fooled’
Proposed algorithms that detect illegal images on devices can be easily fooled with imperceptible changes to images, Imperial research has found.
3303
The Invisible JavaScript Backdoor
A few months ago we saw a post on the r/programminghorror subreddit: A developer describes the struggle of identifying a syntax error resulting from an invisible Unicode character hidden in JavaScript source code. This post inspired an idea: What if a backdoor literally cannot be seen and thus evades detection even…
3304
Tor Browser 11.0
Tor Browser 11.0 is now available from the Tor Browser download page and our distribution directory. This is the first stable release based on Firefox ESR 91, and includes an important update to Tor 0.4.6.8.
3305
ProctorU is dystopian spyware
As part of my MSc, I have to take an online exam. Obviously, this means I am highly likely to cheat by looking up things on Wikipedia or by having a bit of paper with notes on it. EVIL! So, the exam body requires me to install ProctorU. It's a service which lets someone watch you through your laptop camera while you…
3306
$ sudo rm -rf / === NPM install
🔎I authored this blog post whilst I was an employee of Gitpod for Gitpod. I no longer work at Gitpod. In what seems like a long time ago, in part because it is, I learned the catastrophic capabilities of this command the hard way, and I'm sure folks my
3307
REvil Ransom Arrest, $6M Seizure, and $10M Reward
The U.S. Department of Justice today announced the arrest of Ukrainian man accused of deploying ransomware on behalf of the REvil ransomware gang, a Russian-speaking cybercriminal collective that has extorted hundreds of millions from victim organizations. The DOJ also said it had seized $6.1 million in cryptocurrency…
3308
3309
Simple SSH Security
Simple SSH Security Within a couple of minutes you can improve your SSH security significantly.
3310
iPhone apps can tell many things about you through the accelerometer
Nearly every modern smartphone is equipped with an accelerometer, which, as the name implies, is a sensor that measures acceleration. It’s most commonly used for detecting the device’s orientation. It also has many other uses, whether as a game controller in racing games, as a pedometer for counting daily steps, or to…
3311
Six Palestinian organizations hacked with NSO Group’s Pegasus Spyware
On 19 October 2021, Israeli Minister of Defense, Benny Gantz, announced the designation of six leading Palestinian civil society organizations in the Occupied Palestinian Territory as “terrorist organizations” under Israel’s Anti-Terrorism Law 2016. The groups named are Addameer; Al-Haq; Defense for Children …
3312
Beg Bounties
When someone passed me hundreds of thousands of records on kids taken from CloudPets a few years ago [https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/] , I had a nightmare of a time getting in touch with the company. They'd
3313
Faking Twitter unfurling to phish you
Do you trust links? Well, you shouldn’t. Do you trust this link: Twitter says this link should take you to Uniswap, nobody would be none-the-wiser because we…
3314
3315
An opinionated guide on how to reverse engineer software
This is an opinionated guide. After 12 years of reverse engineering professionally, I have developed strong beliefs on how to get good at RE.
3316
Trump’s new social media platform found using Mastodon code
From media reports and individual findings that various people have presented to us, it seems that the new social media platform owned by the former president of the United States, Donald J. Trump, so-called Truth Social, is using Mastodon’s source code with various visual adjustments. The platform has not formally…
3317
Improving first impressions on Signal
The phenomenon of unsolicited and unwanted messaging dates back to the earliest communication platforms: from prehistoric cave graffiti and postal chain letters to popup ads and robocalls. To prevent spam, most online services rely on large-scale inspection of plaintext conversation content or de...
3318
‘Trojan Source’ Bug Threatens the Security of All Code
Virtually all compilers — programs that transform human-readable source code into computer-executable machine code — are vulnerable to an insidious attack in which an adversary can introduce targeted vulnerabilities into any software without being detected, new research released today warns. The vulnerability…
3319
The Patriot Act Has Threatened Freedom for 20 Years
In passing the PATRIOT Act, Congress enacted a “solution” to preventing another 9/11-like debacle without having any evidence that a lack of surveillance powers was what allowed Osama bin Laden’s suicide hijackers to succeed in killing nearly 3,000 Americans.
3320
Encrypting Postgres Data at Rest in Kubernetes
An example of how you can encrypt Postgres data at rest using PGO, the open source Postgres Operator from Crunchy Data using AWS EBS gp2 volumes.
3321
Browser Fingerprinting Without JavaScript
Turning off JavaScript blocks ads but not device tracking. Discover how no-JavaScript fingerprinting works.
3322
Grand jury subpoena for Signal user data, Central District of California
Signal still knows nothing about you, but inexplicably the government continues to ask.
3323
Microsoft has detected nation-state activity associated with NOBELIUM
The Microsoft Threat Intelligence Center (MSTIC) has detected nation-state activity associated with the threat actor tracked as NOBELIUM, attempting to gain access to downstream customers of multiple cloud service providers (CSP), managed service providers (MSP), and other IT services organizations.
3324
Privacy Is a Human Right
Every donation between now and December 31 will be matched, 1:1, by Friends of Tor. Stand up for the human right to privacy and donate to the Tor Project today. Plus… new swag!
3325
EBCDIC is incompatible with GDPR
Welcome to acronym city! The Court of Appeal of Brussels has made an interesting ruling. A customer complained that their bank was spelling the customer's name incorrectly. The bank didn't have support for diacritical marks. Things like á, è, ô, ü, ç etc. Those accents are common in many languages. So it was a little…
3326
NYT journalist hacked with Pegasus after reporting on previous hacking attempts
Our forensic analysis of two iPhones belonging to Hubbard found evidence of Pegasus infections in July 2020 and June 2021. Notably, these infections occurred after Hubbard reported in January 2020 that we found that he was targeted in 2018 by the Saudi Arabia-linked Pegasus operator that we call KINGDOM.
3327
Microsoft no longer signs Windows drivers for Process Hacker
[German]Brief information, which is already here with me since August 2021, but which I have not yet addressed in the blog. David Xanatos has pointed out to me that Microsoft is refusing to sign…
3328
Police can’t demand you reveal your phone passcode then tell a jury you refused
The Utah Supreme Court is the latest stop in EFF’s roving campaign to establish your Fifth Amendment right to refuse to provide your password to law enforcement. Yesterday, along with the ACLU, we filed an amicus brief in State v. Valdez, arguing that the constitutional privilege against self-...
3329
Scientific notation bug in MySQL left AWS WAF vulnerable to SQL injection
We provide around-the-clock threat detection and incident response, backed by expert consulting to keep your organization secure.
3330
