451
New
The latest blog posts to take off on Hacker News. 642 posts.
452
Authorization in a Microservices World
Authorization? How hard can it be? I am pretty sure that others have already solved it. We are not the first ones doing microservices. It should be easy to integrate what's already out there.
453
How we secure Monzo's banking platform
Our Security Infrastructure team introduces the principles we follow to build security in Monzo’s fast-moving engineering environment and how they work with other engineering teams to keep our customers and platform safe.
454
Fake emergency search warrants draw scrutiny from Capitol Hill
On Tuesday, KrebsOnSecurity warned that hackers increasingly are using compromised government and police department email accounts to obtain sensitive customer data from mobile providers, ISPs and social media companies. Today, one of the U.S. Senate’s most tech-savvy lawmakers said he was troubled by the report and…
455
I'm a scam prevention expert and I got scammed
When discussing scams and social engineering attacks, it's easy for security experts to imply the victims of these attacks should have known better. And, as much as we may like to think we'd handle these situations so much better, that's just not true.
456
How Go mitigates supply chain attacks
Go tooling and design help mitigate supply chain attacks at various stages.
457
FORCEDENTRY: Sandbox Escape
Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen...
458
Spring Core on JDK9 is vulnerable to remote code execution
Update: March 31, 2022 A patch has officially been released. https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement https://tanzu.vmware.com/security/cve-2022-22965 Overview Spring Core on JDK9+ is vulnerable to remote code execution due to a bypass for CVE-2010-1622. At the time of writing, this…
459
Stage win: FinFisher is bankrupt
FinFisher, the Munich-based state Trojan exporter, is bankrupt. For over a decade, a wide variety of international groups, including the CCC, have worked toward its end.
460
461
Hackers gaining power of subpoena via fake “emergency data requests”
There is a terrifying and highly effective “method” that criminal hackers are now using to harvest sensitive customer data from Internet service providers, phone companies and social media firms. It involves compromising email accounts and websites tied to police departments and government agencies, and then sending…
462
Today Google is turning on tracking for many users that previously turned it off
Workspace admins can no longer deactivate Google activity tracking for their users, Google says this is helping people.
463
The phones of Ukrainian president Zelensky
Interesting telephone equipment in the offices of Ukrainian president Zelensky
464
Mystery GPS Tracker on a Supporter’s Car
Being able to accurately determine your location anywhere on the planet is a useful technological trick. But when tracking isn’t done by you, but to you—without your knowledge or consent—it’s a violation of your privacy. That’s why at EFF we’ve long fought against dragnet surveillance, mobile...
465
Countering threats from North Korea
On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, …
466
Gaining security and privacy by partitioning the cache | Blog
Chrome's HTTP cache partitioning helps with better security and privacy.
467
Interoperability without sacrificing privacy: Matrix and the DMA
Matrix, the open protocol for secure decentralised communications
468
Racing against the clock – hitting a tiny kernel race window
TL;DR: How to make a tiny kernel race window really large even on kernels without CONFIG_PREEMPT...
469
If you’re not using SSH certificates you’re doing SSH wrong (2019)
SSH has some pretty gnarly issues when it comes to usability, operability, and security. The good news is this is all easy to fix. SSH is ubiquitous. It’s the de-facto solution for remote administration of *nix systems. SSH certificate authentication makes SSH easier to use, easier to operate, and more secure.
470
A Closer Look at the Lapsus$ Data Extortion Group
Microsoft and identity management platform Okta both this week disclosed breaches involving LAPSUS$ , a relatively new cybercrime group that specializes in stealing data from big companies and threatening to publish it unless a ransom demand is paid. Here’s a closer look at LAPSUS$, and some of the low-tech but…
471
472
Another Vulnerability in the LPC55S69 ROM
The discovery of an undocumented hardware block in the LPC55S69.
473
474
DEV-0537 targeting organizations for data exfiltration and destruction
The activity we have observed has been attributed to a threat group that Microsoft tracks as DEV-0537, also known as LAPSUS$. DEV-0537 is known for using a pure extortion and destruction model without deploying ransomware payloads.
475
Nintendo Switch prevents downgrades by irreparably blowing its own fuses (2020)
How the Nintendo Switch uses irreversible hardware fuses to prevent firmware downgrades.
476
477
478
KeePassXC 2.7.0
KeePassXC Password Manager
479
LTrack: Stealthy Tracking of Mobile Phones in LTE
Martin Kotuliak, Simon Erni, Patrick Leu, Marc Röschlin, and Srdjan Čapkun, ETH Zurich
480
Automating cookie consent and GDPR violation detection
The European Union's General Data Protection Regulation (GDPR) requires websites to inform users about personal data collection and request consent for cookies. Yet the majority of websites do not give users any choices, and others attempt to deceive them into accepting all cookies. We document the severity of this…