3481
New
The latest blog posts to take off on Hacker News. 8,771 posts.
3482
SAML Is Insecure by Design
What is SAML? Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties. Source: Wikipedia SAML is often used for single-sign on (“Sign in with Google”, “Sign in with Twitter” etc.). It means when you want to log in to example.com, example.com…
3483
Bombs vs. Bugs
I’ll be taking some time in the next months to talk about the newly hostile-by-default nature of technology, and how I deal with it.
3484
Malicious PyPI packages stealing credit cards and injecting code
JFrog finds a new supply chain attack targeting python developers using the PyPI repository
3485
Infrastructure bill cryptocurrency surveillance provision is a privacy disaster
The forthcoming Senate draft of Biden's infrastructure bill—a 2,000+ page bill designed to update the United States’ roads, highways, and digital infrastructure—contains a poorly crafted provision that could create new surveillance requirements for many within the blockchain ecosystem. This could...
3486
Docker container security cheat sheet
Discover essential Docker Security Best Practices for DevOps engineers and security professionals. Cheat sheet included for quick implementation!
3487
How to boost your popularity on OkCupid using CSRF and a JSON type confusion
This is a quick blog post about a security vulnerability (now fixed) that allowed me to make anyone like or message a profile on okcupid.com simply by getting them to click a link on my website. In doing so, I used one of the most boring web application security issues (CSRF) combined with a somewhat interesting JSON…
3488
A wiper attack paralyzed the Iranian train system
In the midst of an epic troll on a country-wide railway system, we discovered a new threat actor and their reusable wiper called Meteor.
3489
Scanning your iPhone for Pegasus
Scan your iPhone for NSO Group's Pegasus malware using Mobile Verification Toolkit (MVT) by Amnesty International
3490
Cloudflare's inaccessible browser contradicts the company's mission
About four months ago, Cloudflare launched Browser Isolation during Security Week, without ensuring that the product is accessible to blind people using screen readers. Now, four months later, this problem is still not solved. Cloudflare’s neglect of accessibility in this product raises a new barrier to employment for…
3491
Probably Are Gonna Need It: Application Security Edition
My list of “Probably Are Gonna Need It” security features for your web app – things that you should build up-front, not wait until you need them (when it’s already too late).
3492
3493
Cryptanalysis of Meow Hash
The creators of Meow hash made security claims; we break them all.
3494
Google launches new vulnerability reward platform
Posted by Jan Keller, Technical Program Manager, Google VRP A little over 10 years ago , we launched our Vulnerability Rewards Program (VR...
3495
The Insecurity Industry
The greatest danger to national security has become the companies claiming to protect it
3496
Autofill in password managers can allow login credentials to be stolen
Security Researcher | Ethical Hacker | Web Application Security
3497
3498
Google results for PHP tutorials contain SQL injection vulnerabilities
Today, out of curiosity, I googled for php mysql email register . This returns tutorials, how-tos, code snippets. Most results include flawed DB statements. This usually means something like
3499
Freenom, the free domains website, is a scam
Self-taught developer. Go, Rust, Python and Javascript. - hackermondev
3500
Cloudflare's Handling of an RCE Vulnerability in Cdnjs
Recently, a RCE vulnerability in the way cdnjs’ backend is automatically keeping web resources up to date has been disclosed. Read about how Cloudflare handled the security incident and what will prevent similar exploits in the future.
3501
HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10
This is the story of how all non-admin users can read the registry — and so elevate privileges and access sensitive credential information…
3502
Bringing supply chain security features to the Go community
GitHub’s supply chain security features are now available for Go modules, which will help the Go community discover, report & prevent vulnerabilities.
3503
How to exfiltrate code from Bitbucket
Every year or so, something compels me to start over with a fresh OS image. Most recently, that something was an unfortunate water bottle incident. Once again, I need to pull down my digital life from the internet. The code and assets for this blog currently live in a 500 MB Git repository, which was hosted on…
3504
3505
Serial swatter who caused death gets five years in prison
A 18-year-old Tennessee man who helped set in motion a fraudulent distress call to police that led to the death of a 60-year-old grandfather in 2020 was sentenced to 60 months in prison today.
3506
NSO Group Hacked
NSO Group, the Israeli cyberweapons arms manufacturer behind the Pegasus spyware—used by authoritarian regimes around the world to spy on dissidents, journalists, human rights workers, and others—was hacked. Or, at least, an enormous trove of documents was leaked to journalists. There’s a lot to read out there…
3507
A case against security nihilism
This week a group of global newspapers is running a series of articles detailing abuses of NSO Group’s Pegasus spyware. If you haven’t seen any of these articles, they’re worth re…
3508
Stopping FTP support in Firefox 90
The File Transfer Protocol (FTP) has long been a convenient file exchange mechanism between computers on a network. While this standard protocol has been supported in all major browsers ...
3509
Don’t Wanna Pay Ransom Gangs? Test Your Backups
Browse the comments on virtually any story about a ransomware attack and you will almost surely encounter the view that the victim organization could have avoided paying their extortionists if only they’d had proper data backups. But the ugly truth is there are many non-obvious reasons why victims end up paying even…
3510
Forensic Methodology Report: How to catch NSO Group’s Pegasus
NSO Group claims that its Pegasus spyware is only used to “investigate terrorism and crime” and “leaves no traces whatsoever”. This Forensic Methodology Report shows that neither of these statements are true. This report accompanies the release of the Pegasus Project, a collaborative investigation that involves more…