5821
New
The latest blog posts to take off on Hacker News. 8,772 posts.
5822
Equifax Argentinian portal secured with admin/admin
Equifax last week disclosed a historic breach involving Social Security numbers and other sensitive data on as many as 143 million Americans. The company said the breach also impacted an undisclosed number of people in Canada and the United Kingdom. But the official list of victim countries may not yet be complete…
5823
Blueborne – A new attack vector endangering major operating systems
Following the disclosure of the BlueBorne attack vector this past September, Armis discovered that critical Bluetooth vulnerabilities impact the Amazon Echo and Google Home.
5824
Curl’s backdoor threat
-- "Have you ever detected anyone trying to add a backdoor to curl?" -- "Have you ever been pressured by an organization or a person to add suspicious code to curl that you wouldn't otherwise accept?" -- "If a crime syndicate would kidnap your family to force you to comply, what backdoor would you be … Continue…
5825
Chrome's Plan to Distrust Symantec Certificates
Posted by Devon O’Brien, Ryan Sleevi, Andrew Whalley, Chrome Security This post is a broader announcement of plans already finalized on t...
5826
A Hardware Privacy Monitor for iPhones
Andrew “bunnie” Huang and Edward Snowden have designed a hardware device that attaches to an iPhone and monitors it for malicious surveillance activities, even in instances where the phone’s operating system has been compromised. They call it an Introspection Engine, and their use model is a journalist who is…
5827
Mastercard Internet Gateway Service: Hashing Design Flaw
Last year I found a design error in the MD5 version of the hashing method used by Mastercard Internet Gateway Service. The flaw allows modification of transaction amount. They have awarded me with a bounty for reporting it. This year, they have switched to HMAC-SHA256, but this one also has a flaw
5828
Apache Struts Statement on Equifax Security Breach
UPDATE: MEDIA ALERT: The Apache Software Foundation Confirms Equifax Data Breach Due to Failure to Install Patches Provided for Apache® Struts™ Exploit The Apache Struts Project Management Committee (PMC) would like to comment on the Equifax security breach, its relation to the Apache Struts Web Framework and…
5829
5830
5831
Cryptographic vulnerabilities in IOTA
Last month, Ethan Heilman, Tadge Dryja, Madars Virza, and I took a look at IOTA, currently the 8th largest cryptocurrency with a $1.9B…
5832
Software to capture votes in upcoming German national election is insecure
The Chaos Computer Club is publishing an analysis of software used for tabulating the German parliamentary elections (Bundestagswahl). The analysis shows a host of problems and security holes, to...
5833
Playing with Kernel TLS in Linux 4.13 and Go
The 1600 LoC patch allows userspace to pass the kernel the encryption keys for an established connection, making encryption happen transparently inside the kernel.
5834
5835
Leaked document: EU Presidency calls for massive internet filtering
A Council of the European Union document leaked by Statewatch on 30 August reveals that during the summer months, that Estonia (current EU Presidency) has been pushing the other Member States to strengthen indiscriminate internet surveillance, and to follow in the footsteps of China regarding online censorship…
5836
Run your own OAuth2 server
Run a free OAuth2 Server and OpenID Connect (OIDC) server using open source software in under 10 minutes, and become an OAuth2 provider like Google.
5837
5838
5839
SIDH in Go for quantum-resistant TLS 1.3
Most of today's cryptography is designed to be secure against an adversary with enormous amounts of computational power. This means estimating how much work certain computations require, and choosing cryptographic parameters based on our best estimates.
5840
Internet Censorship Bill Could Spell Disaster for Speech and Innovation
There’s a new bill in Congress that would threaten your right to free expression online. If that weren’t enough, it could also put small Internet businesses in danger of catastrophic litigation. Don’t let its name fool you: the Stop Enabling Sex Traffickers Act (SESTA, S. 1693) wouldn’t help punish...
5841
Twitter Bots Use Likes, RTs for Intimidation
I awoke this morning to find my account on Twitter ( @briankrebs ) had attracted almost 12,000 new followers overnight. Then I noticed I’d gained almost as many followers as the number of re-tweets (RTs) earned for a tweet I published on Tuesday . The tweet stated how every time I tweet something related to Russian…
5842
Hardening the Kernel in Android Oreo
News and insights on the Android platform, developer tools, and events.
5843
5844
Restic Cryptography
tl;dr: this is not an audit and I take no responsibility for your backups, but I had a quick look at the crypto and I think I’m going to use restic for my personal backups.
5845
Multiple vulnerabilities in RubyGems
There are multiple vulnerabilities in RubyGems bundled by Ruby.It is reported at the official blog of RubyGems.
5846
When it comes to internet privacy, be afraid, analyst suggests
Cybersecurity expert Bruce Schneier, a fellow with the Berkman Klein Center for Internet & Society, discusses what consumers can do to protect themselves from government and corporate surveillance.
5847
5848
The qmail security guarantee
Of course, ``security hole in qmail'' does not include problems outside of qmail: for example, NFS security problems, TCP/IP security problems, DNS security problems, bugs in scripts run from .forward files, and operating system bugs generally. It's silly to blame a problem on qmail if the system was already…
5849
5850