3361
New
The latest blog posts to take off on Hacker News. 8,771 posts.
3362
The Rise of One-Time Password Interception Bots
In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords (OTPs) that many websites require as a second authentication factor in addition to passwords. That service quickly went offline, but new research reveals a number of competitors have since…
3363
Always-on Processor magic: How Find My works while iPhone is powered off
Wireless and firmware hacking, PhD life, Technology
3364
Kraken Security Labs Identifies Vulnerabilities in Commonly Used Bitcoin ATM
Bitcoin ATMs offer a convenient and friendly way for consumers to purchase cryptocurrencies. That ease of use can sometimes come at the expense of security. Kraken Security Labs has uncovered multiple hardware and software vulnerabilities in a commonly used cryptocurrency ATM: The General Bytes BATMtwo (GBBATM2)…
3365
Private censorship is not the best way to fight hate or defend democracy (2018)
From Cloudflare’s headline-making takedown of the Daily Stormer last autumn to YouTube’s summer restrictions on LGBTQ content, there's been a surge in “voluntary” platform censorship. Companies—under pressure from lawmakers, shareholders, and the public alike—have ramped up restrictions on speech,...
3366
Apple AirTag Bug Enables ‘Good Samaritan’ Attack
The new $30 AirTag tracking device from Apple has a feature that allows anyone who finds one of these tiny location beacons to scan it with a mobile phone and discover its owner’s phone number if the AirTag has been set to lost mode. But according to new research, this same feature can be abused to redirect the Good…
3367
3368
Fail2ban – Remote Code Execution
Securitum is a pure pentesting company specialising in the security of IT systems. We have experience in performing security audits (including penetration tests) - mainly for financial/e-commerce/industrial sectors. We have performed penetration tests and cyber security services for leading European banks (see…
3369
DoS attacks against my online game
DDraceNetwork is an open source online game I’ve been running since 2013 with a community of volunteers. The game is available for free, I’m hosting servers for it in many countries around the world so that we have trusted official ranks . The servers are paid for by donations , which I stop collecting once the cost…
3370
3371
Developers fix multitude of vulnerabilities in Apache HTTP Server
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
3372
Your face is not a bar code: arguments against automatic face recognition (2001)
An abridged version of this article appeared in Whole Earth 106, Winter 2001, pages 74-77.
3373
3374
Authenticated Boot and Disk Encryption on Linux
Posts and writings by Lennart Poettering
3375
3376
How WhatsApp enables multi-device capability
For years, people have been asking us to create a true multi-device experience that allows people to use WhatsApp on other devices without requiring a smartphone connection. Today, we’re announcing…
3377
3378
Database containing personal info of 106M visitors to Thailand exposed online
Just how safe is your personal information? With more than thousand reported data breaches since 2004, the odds are not in your favor.
3379
3380
Microsoft ruined passwords, now aims for a passwordless future
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
3381
Let's Encrypt's old root certificate is expiring
On 30th September 2021, the root certificate that Let's Encrypt are currently using, the IdentTrust DST Root CA X3 certificate, will expire. You may or may not need to do anything about this Root CA expiring, but I'm betting a few things will probably break on that day
3382
Google Docs in a clean-room browser
A detailed description of how we made Google Docs run inside the new Flow Browser. The number of websites that work in Flow is increasing regularly.
3383
Imaging mounted disk volumes under duress
Backups are critical. If you are lucky and organised you have a set of useful backup primitives, such as Point in Time snapshots on your Infrastructure As A Service (IaaS), your disk array controller, or volume manager. However there always seems to be some critical machine in my life that does not fall into these…
3384
VPN users unmasked by zero-day vulnerability in Virgin Media routers
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
3385
Zerotier – multiple vulnerabilities lead to private network access
Zerotier - Multiple vulnerabilities leading to identity hijacking and unauthorised private network access.
3386
3387
The pitfalls of using SSH-agent, or how to use an agent safely
Unfortunately for you, we promised a follow up to talk about the security implications of using such an agent. So, here we are.
3388
Alexa leaks private wishlists
This morning, my wife noticed that Alexa was insistently flashing its little blue lights. "Alexa... Notifications?" "You have one notification. An item on your wishlist has dropped in price. The … is now only £…" And that's how my wife found out what I planned to get her for her birthday! What happened to cause this?…
3389
Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
The Lumen blog and newsroom is your source for business technology news and insights, customer stories, press and media, and trending articles.
3390
You don't need to burn off your fingertips (and other biometric myths)
111 years ago almost to the day, a murder was committed which ultimately led to the first criminal trial to use fingerprints as evidence [https://www.smithsonianmag.com/history/first-case-where-fingerprints-were-used-evidence-180970883/] . We've all since watched enough crime shows to understand that fingerprints are