5011
New
The latest blog posts to take off on Hacker News. 8,772 posts.
5012
5013
5014
Obfuscated JavaScript, scam emails, and American Express
Reverse-engineering an obfuscated American Express phishing campaign from email to exfiltration endpoint.
5015
5016
5017
Microsoft Azure data deleted because of DNS outage
The Sophos Blog
5018
New study: Google manipulates users into constant tracking
Today, the Norwegian Consumer Council has filed a complaint against Google. Based on new research Google is accused of using deceptive design and misleading information, which results in users accepting to be constantly tracked
5019
CCPA Will Hit Dev Teams Harder Than GDPR
CCPA impacts dev teams more than GDPR. Learn who must comply, what data is covered, and how to protect test data safely.
5020
Everything you ever wanted to know about building a secure password reset (2012)
This content is now available in the Pluralsight course "Secure Account Management Fundamentals" [http://www.pluralsight.com/courses/secure-account-management-fundamentals] Recently I’ve had a couple of opportunities to think again about how a secure password reset function should operate, firstly whilst building this…
5021
5022
5023
The Day I Fell in Love with Fuzzing
In 2007 I wrote a pair of modding tools, binitools , for a space trading and combat simulation game named Freelancer . The game stores its non-art assets in the format of “binary INI” files, or “BINI” files. The motivation for the binary format over traditional INI files was probably performance: it’s faster to load…
5024
I exploited TLS-SNI-01 issuing Let's Encrypt SSL-certs for any domain (2018)
The original research reports on security issues found in ACME TLS-SNI-01 which caused Let's Encypt to sunset it.
5025
We value your privacy now, but maybe not later
Everybody knows these modal dialogs when visiting a website for the first time that ask you to accept cookies and consent to being tracked by third-party advertising networks. It actually became a habit for me to always click through these things and reject any kind of tracking or use of my personal information except…
5026
Steganography Based Ad Payload That Drops Shlayer Trojan on Mac Users
Recent months have seen an uptick in reports of JavaScript malware that hides in image files.
5027
Fearless Security: Memory Safety
Memory safety violations can cause programs to crash unexpectedly and can be exploited to alter intended behavior--languages can manage this multiple ways
5028
5029
Remote code execution vulnerability in apt/apt-get
tl;dr I found a vulnerability in apt that allows a network man-in-the-middle (or a malicious package mirror) to execute arbitrary code as root on a machine i...
5030
5031
5032
Supporters of Mexico’s Soda Tax Targeted with NSO Exploit Links (2017)
An investigation revealing that Mexican soda tax supporters were targeted with NSO Group's government-exclusive spyware and exploit framework.
5033
773M Password ‘Megabreach’ Is Years Old
My inbox and Twitter messages positively lit up today with people forwarding stories from Wired and other publications about a supposedly new trove of nearly 773 million unique email addresses and 21 million unique passwords that were posted to a hacking forum. A story in The Guardian breathlessly dubbed it “the…
5034
How to write a rootkit without really trying
We open-sourced a fault injection tool, KRF, that uses kernel-space syscall interception. You can use it today to find faulty assumptions (and resultant bugs) in your programs. Check it out! This post covers intercepting system calls from within the Linux kernel, via a plain old kernel module. We’ll go through a quick…
5035
Oklahoma Department of Securities Leaked Millions of Files
A storage server configured for public access exposed millions of files belonging to the Oklahoma Securities Commission.
5036
5037
The 773M Record “Collection #1” Data Breach
Many people will land on this page after learning that their email address has appeared in a data breach I've called "Collection #1". Most of them won't have a tech background or be familiar with the concept of credential stuffing so I'm going to write this post
5038
5039
Airbnb and security camera disclosure
This post got *a lot* of attention. I’m super happy about that because I had been afraid that we had reached a point where we collectively didn’t care about cameras or meaningful disclosure. Although, to that point here’s a comment someone posted: "I just assume that there will be camera constantly recording when I…
5040
Reverse engineering GoDaddy's tracking script
An article by Igor Kromin has provided an insight into a practice by GoDaddy involving injecting Javascript into customer sites. Several people expressed interest in a breakdown of the script - so here it is. Please review Igor’s original blog for further background