31
TP-Link Archer VR1600V V2 Super User Password Cracked
Well the news is out, I won’t explain the method for reasons, but our code warriors have a new fight. After requesting the SU password, they were told flat out it doesn’t exist and refe…
New
The latest blog posts to take off on Hacker News. 612 posts.
32
Should There Be Limits on Persuasive Technologies?
Persuasion is as old as our species. Both democracy and the market economy depend on it. Politicians persuade citizens to vote for them, or to support different policy positions. Businesses persuade consumers to buy their products or services. We all persuade our friends to accept our choice of restaurant, movie, and…
33
The cleverest floppy disc protection ever? Western Security Ltd
Introduction I've been on a bit of a floppy disc protection odyssey recently. This will probably be the last floppy disc related post for so...
34
Coordinated disclosure of XML roundtrip vulnerabilities in Go’s standard library
We have identified three independently exploitable vulnerabilities in Go's encoding/xml. Read more about their impact to Mattermost users.
35
U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise
Communications at the U.S. Treasury and Commerce Departments were reportedly compromised by a supply chain attack on SolarWinds , a security vendor that helps the federal government and a range of Fortune 500 companies monitor the health of their IT networks. Given the breadth of the company’s customer base, experts…
36
37
Privacy matters even if “you have nothing to hide”
Self-hosted and privacy-respecting blog software that puts the domain, data, and reader relationship back in your hands. Private alternatives to Medium, vetted since 2015.
38
Highly Evasive Attacker Leverages SolarWinds Supply Chain
Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.
39
SCOTUS rules you may sue government agents for damages when they violate rights
Arlington, Va.—In a unanimous opinion issued today by the U.S. Supreme Court, and authored by Associate Justice Clarence Thomas, the Court ruled in Tanzin v. […]
40
I Hacked into Facebook's Legal Department Admin Panel
Alaa Abdulridha — Engineering Director at SerpApi & Cybersecurity Researcher. Expert in web application penetration testing, reverse engineering, bug bounty programs, and secure code development. Passionate about discovering vulnerabilities, building scalable systems, and teaching practical cybersecurity techniques.
41
42
Anti-fingerprinting extensions tend to make fingerprinting easier
Browser extensions claiming to protect against fingerprinting will typically result in more data available for fingerprinting.
43
FireEye Shares Details of Recent Cyber Attack
Trellix XDR, get the latest cybersecurity trends, best practices, security vulnerabilities, and more from industry leaders.
44
45
Good-bye ESNI, hello ECH!
A deep dive into the Encrypted Client Hello, a standard that encrypts privacy-sensitive parameters sent by the client, as part of the TLS handshake.
46
Improving DNS Privacy with Oblivious DoH
Oblivious DoH (ODoH) makes secure DNS over HTTPS (DoH) queries into private queries which prevent the leakage of client IP addresses to resolvers. The new proposed ODoH standard addresses this problem and today we are enabling users to use this protocol with 1.1.1.1
47
48
Macs with T2, M1 chips cannot be restored to factory state without Apple
Modern Apple computers can no longer be fully used and maintained in 100% offline environments, or in ways that will reasonably ensure that the computer is…
49
InstaHide Disappointingly Wins Bell Labs Prize, 2nd Place
[What follows are my thoughts on some recent research in machine learning privacy. These are my thoughts, and do not represent those of others.]
50
How does Brown University know where you are?
In September 2020, Brown University accused students of lying about their location; e.g.:
51
72% of smart TVs and 46% of game consoles hardcode DNS settings
Welcome Hacker News readers!• Thank you to M. Hammad Mazhar for his research that inspired this guide.• @healyio made some great additional suggestions in th...
52
I accidentally built a spying app
A personal story about creating new products and their unintended consequences
53
Cyberespionage Using SS7 via Circles
Circles is a surveillance firm that reportedly exploits weaknesses in the global mobile phone system to snoop on calls, texts, and the location of phones around the globe, and is affiliated with NSO Group, which develops the oft-abused Pegasus spyware. Using Internet scanning, we found a unique signature associated…
54
Linux kernel heap quarantine versus use-after-free exploits
It's 2020. Quarantines are everywhere – and here I'm writing about one, too. But this quarantine is of a different kind. In this article I'll describe the Linux Kernel Heap Quarantine that I developed for mitigating kernel use-after-free exploitation.
55
An iOS zero-click radio proximity exploit odyssey
Posted by Ian Beer, Project ZeroNOTE: This specific issue was fixed before the launch of Privacy-...
56
Yet another macOS privacy protections bypass
Today I'm disclosing a macOS privacy protections bypass. I discovered that an application can use the venerable Unix command-line tool "ls" (list directory contents) to bypass both TCC (Transparency, Consent, and Control) and the sandbox, enabling unauthorized access to file metadata in directories that are supposed…
57
GPG and Me (2015)
I receive a fair amount of email from strangers. My email address is public, which doesn’t seemto be a popular choice these days, but I’ve received enough inspiring correspondence over the yearsto leave it be.When I receive a GPG encrypted email from a stranger, though, I immediately get the fee...
58
59
CAPTCHAs don’t prove you’re human – they prove you’re American (2017)
When I was a small child, I took an IQ test. One of the first questions I stumbled on was "A piece of candy costs 25¢. Jonny has a dime. How many nickels does he need to buy the candy?" My 7-year old brain popped. WTAF is a nickel? Or a dime for that matter? We don't have those coins in my country! We don't spend in ¢…
60
hCaptcha now runs on fifteen percent of the internet
Discover how hCaptcha has become the largest independent CAPTCHA service and now runs on 15% of the internet.