4591
Weaponizing and Gamifying AI for WiFi Hacking: Presenting Pwnagotchi 1.0.0
This is the story of a summer project that started out of boredom and that evolved into something incredibly fun and unique. It is also the story of how that p…
New
The latest blog posts to take off on Hacker News. 8,771 posts.
4592
DNS Security: Threat Modeling DNSSEC, DoT, and DoH
There's been a lot of talk about DNS-over-HTTPS aka DoH lately, primarily due to Mozilla's and Google's respective plans to move forward with enabling it in their browsers. There's also a lot of misunderstanding and conflation of speculated plans for world domination with practical benefits of the technology; it…
4593
OnionShare makes it easy to publish anonymous, uncensorable websites
I’m excited to announce that OnionShare 2.2 is released! You can download it from onionshare.org. When I first wrote OnionShare in 2014, it let you anonymously and securely send files to people. It worked like this: OnionShare zips up the files, starts a local web server on
4594
4595
Victory! Ruling in hiQ v. Linkedin Protects Scraping of Public Data
In a long-awaited decision in hiQ Labs, Inc. v. LinkedIn Corp., the Ninth Circuit Court of Appeals ruled that automated scraping of publicly accessible data likely does not violate the Computer Fraud and Abuse Act (CFAA). This is an important clarification of the CFAA’s scope, which should provide...
4596
Stealing sensitive browser data with the W3C Ambient Light Sensor API (2017)
In this post we describe and demonstrate a neat trick to exfiltrate sensitive information from your browser using a surprising tool: your smartphone or laptop’s ambient light sensor. In short: 1. We provide background about the light sensor API and current discussions to expose it more broadly to websites.
4597
Reversing Safeway's private APIs to automate coupon collection
Reverse-engineering Safeway's coupon APIs to automate adding digital offers to an account.
4598
China's New Cybersecurity Program: No Place to Hide
Chinese distributors can help foreign companies reach customers without setting up a business in China. The wrong agreement can leave a supplier locked into years of poor sales, trademark disputes, or regulatory problems. Here are ten issues we address before a client signs.
4599
4600
Monzo: How our security team handle secrets
We recently designed a new system to manage secret information safely – from the keys that we use to sign your Mastercard transactions, to credentials for external services.
4601
Pair Locking Your iPhone
Learn how to pair lock your iPhone to break law enforcement forensics tools and protect your data.
4602
Critical Security Issue Identified in iTerm2
A security audit funded by Mozilla has discovered a critical security vulnerability in the widely used macOS terminal emulator iTerm2.
4603
Ken Thompson's Unix Password
Somewhere around 2014 I found an /etc/passwd file in some dumps of the BSD 3 source tree, containing passwords of all the old timers such as Dennis Ritchie, Ken Thompson, Brian W. Kernighan, Steve Bourne and Bill Joy.
4604
Designing a COM Library for Rust
I interned with Microsoft as a Software Engineering Intern in the MSRC UK team in Cheltenham this past summer. I worked in the Safe Systems Programming Language (SSPL) group, which explores safe programming languages as a proactive measure against memory-safety related vulnerabilities.
4605
Elliptic Curve Cryptography Explained
Fang-Pen Lin's blog about programming
4606
My application ran away and called home from Redmond
I recently found a surprising leak vector in Windows 10 installations. We were porting our Beacon to Windows and for easy deployment…
4607
4608
VPN⁰: A Privacy-Preserving Distributed VPN
This research presents VPN⁰, the first distributed virtual private network offering a privacy preserving traffic authorization and validation mechanism.
4609
Open Letter from Governments to Facebook Is an All-Out Attack on Encryption
Top law enforcement officials in the United States, United Kingdom, and Australia told Facebook today that they want backdoor access to all encrypted messages sent on all its platforms. In an open letter, these governments called on Mark Zuckerberg to stop Facebook’s plan to introduce end-to-end...
4610
EFF Wins Access to License Plate Reader Data to Study Law Enforcement Use
San Francisco—Electronic Frontier Foundation (EFF) and the American Civil Liberties Union Foundation of Southern California (ACLU SoCal) have reached an agreement with Los Angeles law enforcement agencies under which the police and sheriff’s departments will turn over license plate data they...
4611
4612
An Update on Plugin Security
Learn about Figma's response to the security vulnerabilities that were reported in a 3rd-party library that we use for plugin security
4613
How a double-free bug in WhatsApp turns to remote code execution
In this blog post, I’m going to share about a double-free vulnerability that I discovered in WhatsApp for Android, and how I turned it into an RCE. I informed this to Facebook. Facebook acknowledged and patched it officially in WhatsApp version 2.19.244. Facebook reserved CVE-2019-11932 for this issue.
4614
4615
4616
Keybase iOS Has a Backdoor?
Keybase’s iOS client has received a backdoor. It seems that Stellar, the extremely well-funded and well-marketed cryptocurrency, has struck a deal with Keybase…
4617
Wireless attacks on aircraft instrument landing systems
Wireless attacks on aircraft instrument landing systems Sathaye et al., USENIX Security Symposium 2019 It’s been a while since we last looked at security attacks against connected real-world entiti…
4618
Tethered Jailbreaks Are Back
Earlier today, a new iPhone Boot ROM exploit, checkm8 (or Apollo or Moonshine), was published on GitHub by axi0mX, affecting the iPhone 4S through the iPhone X. The vulnerability was patched in devices with A12 and A13 CPUs. As of this writing, the iPhone XS, XS Max, XR, 11, 11 Pro and 11 Pro Max […]
4619
MyPayrollHR CEO Arrested, Admits to $70M Fraud
Earlier this month, employees at more than 1,000 companies saw one or two paycheck’s worth of funds deducted from their bank accounts after the CEO of their cloud payroll provider absconded with $35 million in payroll and tax deposits from customers . On Monday, the CEO was arrested and allegedly confessed that the…
4620