541
Hardware trojans under a microscope (2022)
Table of Contents
New
The latest blog posts to take off on Hacker News. 617 posts.
542
Voice.ai: GPL Violations with a Side of DRM
the one good use of copyright is prying things open
543
Weakening TLS protection, South Korean style
TLS protocol is fundamental to internet security. All South Korean security applications add their own “trusted” Certificate Authorities however, weakening this protocol severely.
544
Finland’s most-wanted hacker nabbed in France
Julius “Zeekill” Kivimäki, a 25-year-old Finnish man charged with extorting a local online psychotherapy practice and leaking therapy notes for more than 22,000 patients online, was arrested this week in France. A notorious hacker convicted of perpetrating tens of thousands of cybercrimes, Kivimäki had been in hiding…
545
I use C when I believe in memory safety
I am using C for a professional project. I believe in memory safety. Yes, I'm a hypocrite, but please, let me explain.
546
Reverse-Engineering YouTube: Revisited
Back in 2017 I wrote an article in which I attempted to explain how YouTube works under the hood, how it serves streams to the client, and also how you can exploit that knowledge to download videos from the site. The primary goal of that write-up was to…
547
Want anonymity? Make a persona not a mystery
Derek Sivers official site. Thoughts on philosophy, culture, self-improvement. Author of Useful Not True, How to Live, Hell Yeah or No, Anything You Want.
548
Reversing UK mobile rail tickets
The UK has used small credit-card sized tickets to pay for train travel for years and years, since long before I was born — originally theAPTIS ticket1,which...
549
Against risk-based authentication (or, why I wouldn't trust Google Cloud)
If you were deciding on whether to use AWS, Azure or Google Cloud for a production application, what factors would you use to make the decision? There are probably many such factors you might think of, but I'd like to point out one that probably isn't commonly considered: the relative trustworthiness of Google's…
550
Stop the proposal on mass surveillance of the EU
The European Commission is currently in the process of enacting a law called Chat control. If the law goes into effect, it will mean that all EU citizens' communications will be monitored and listened to.
551
Google's OSS-Fuzz expands fuzz-reward program
Posted by Oliver Chang, OSS-Fuzz team Since launching in 2016 , Google's free OSS-Fuzz code testing service has helped get over 8800 vul...
552
Ronin 2.0 – open-source Ruby toolkit for security research and development
After nearly a full year of non-stop development since the initial announcement of The Big Refactor , 4153 commits made, 700 issues closed , and a month of beta testing, Ronin 2.0.0 has finally been released!
553
A novel PayPal scam
This morning I received an interesting scam email. It might not be a new scam, but it was the first time I’d seen it.
554
Data-Free Disneyland
(Note: This is the companion post to my article at Public Books about evading data detection at Disneyland. For the…
555
Operation Luigi: How I hacked my friend without her noticing (2017)
My friend gave me permission to hack her, here's how I did it and how to stop it happening to you.
556
EU chat control law will ban open source operating systems
Update: Open source OSes might be saved from being covered depending on the interpretation of EU regulation 2019/1150 2.2.c.
557
Modernizing C arrays for greater memory safety: a case study in the Linux kernel
How to modernize C arrays for greater memory safety: a case-study in refactoring the Linux kernel and a look to the future Kees Cook C i...
558
How likely is losing a Google account?
Let's say you use a Google account as the root of your online identity: Gmail, Fi, "Sign in with Google", Google's password manager, etc. How much should you be worried that you'll suddenly find yourself unable to get into everything? Should you do something else instead? To get a sense of how common lockouts are and…
559
UK Online Safety Bill threatens encryption, secure communication, and reporting
Does the image above, depicting the rescue of a child who attempted to reach the U.K. by sea, present the act of immigration in “a positive light”? It’s an absurd question, of course. It’s journalism – an effort to convey in visual terms the stark truth that tens of thousands of migrants and asylum-seekers try to…
560
561
An investigation into Apple’s new Relay network
Guest Post: Analysing Apple Private Relay’s effects on the Internet and future measurement-based research.
562
Kevin Mitnick Hacked California Law in 1983
Early in his career, Kevin Mitnick successfully hacked California law. He told me the story when he heard about my new book, which he partially recounts his 2012 book, Ghost in the Wires. The setup is that he just discovered that there’s warrant for his arrest by the California Youth Authority, and he’s trying to…
563
564
IPinside: Korea’s Mandatory Spyware
Banking websites in South Korea can only be used with IPinside installed. This application collects lots of data about the user, and it makes that data accessible to each and every website. The protection is inadequate.
565
Evidence that Adani Group has engaged in stock manipulation and accounting fraud
Initial Disclosure: After extensive research, we have taken a short position in Adani Group Companies through U.S.-traded bonds and non-Indian-traded derivative instruments. This report relates solely to the valuation of securities traded outside of India. This report does not constitute a recommendation on…
566
How the Xbox 360 knows if your hard drive is genuine
Reverse engineering the kernel-mode authenticity check, and how Microsoft knows about your hacked/custom hard-drive.
567
The Git source code audit, viewed as a Rust programmer
On January 17th 2023, X41 and Gitlab published a report of the source code audit they performed on Git (funded by the OSTIF foundation).
568
569
Bitwarden design flaw: Server side iterations
Bitwarden is a hot candidate for a LastPass replacement. Looking into how they encrypt data, it doesn’t do things that much better however.
570
How we turned the tables to catch my sister’s Bumble stalker
My sister’s stalker, who had used Instagram and Bumble to work out where she lived and start stalking her in real life, was recently…