571
New
The latest blog posts to take off on Hacker News. 617 posts.
572
Pwning the all Google phone with a non-Google bug
It turns out that the first “all Google” phone includes a non-Google bug. Learn about the details of CVE-2022-38181, a vulnerability in the Arm Mali GPU. Join me on my journey through reporting the vulnerability to the Android security team, and the exploit that used this vulnerability to gain arbitrary kernel code…
573
574
Bypassing Gmail's spam filters with ChatGPT
If you haven’t been living under a rock, you probably already know what ChatGPT is. I am an operator of high bandwidth Tor exit relays, and with that, I get a lot of abuse complaints. Combined with the fact that I have ai lease on a “/24” of IPv4 space, basically a block of 256 IP addresses, I have the IP space’s…
575
Detect breaches with Canary credit cards
Detect breaches with Canary credit cards! TL;DR; Today we’re releasing a new Canarytoken type: actual credit cards! Head over to canarytokens.org; We give you a valid credit card (number, expiration, and CVC); If anyone ever attempts to use that card you’ll be notified. We recommend placing one anywhere you store…
576
Official Warning: Zero3K
You are seeing this because the administrator of this website has set up Anubis to protect the server against the scourge of AI companies aggressively scraping websites . This can and does cause downtime for the websites, which makes their resources inaccessible for everyone.
577
Is Apple checking images we view in the Finder?
Can it be true that Apple is sent information about every image we browse in the Finder? Analysis of Visual Look Up and Live Text and when it happens.
578
Information about a recent security incident at Mailchimp
Maintaining our security commitment to our customers
579
How to own an airline in 3 easy steps and grab the TSA nofly list along the way
and grab the TSA nofly list along the way
580
Exploiting null-dereferences in the Linux kernel
Posted by Seth Jenkins, Project Zero For a fair amount of time, null-deref bugs were a highly e...
581
Pwned or Bot
It's fascinating to see how creative people can get with breached data. Of course there's all the nasty stuff (phishing, identity theft, spam), but there are also some amazingly positive uses for data illegally taken from someone else's system. When I first built Have I Been Pwned
582
An aggressive, stealthy web spider operating from Microsoft IP space
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
583
Bitwarden Acquires Passwordless.dev
Bitwarden has acquired European-based startup Passwordless.dev, a significant milestone in rounding out the Bitwarden commitment to offering open source, scalable, and secure passwordless solutions to every business and end user.
584
Hyundai Head Unit Hacking
Standard-class Gen5 navigation
585
Git security vulnerabilities announced
Git users are encouraged to upgrade to the latest version, especially if they use `git archive`, work in untrusted repositories, or use Git GUI on Windows.
586
Glitching a microcontroller to unlock the bootloader
Back in the summer I was lucky enough to finagle my boss into letting me take Dmitry Nedospasov ( @nedos )’s hardware hacking training . In it I cut my teeth on using an FPGA to interface with target hardware. After implementing a UART we implemented a module that could parse part of Apple’s OneWire, used to negotiate…
587
How my brother's iCloud account was stolen
My brother got his iPhone stolen at gunpoint. This is the story of how he lost control of his iCloud account first (along with years of priceless memories, including my nephew's first steps) and how this couldn't have happened without Apple's incompetent support.
588
The IAB loves tracking users but hates users tracking them
The Interactive Advertising Bureau (IAB) is a standards development group for the advertising industry. Their members love tracking users. They want to know where you are, who you're with, what you're buying, and what you think. All so they can convince you to spend slightly more on toothpaste. Or change your…
589
Apple Has Begun Scanning Your Local Image Files Without Consent
Preface: I don’t use iCloud. I don’t use an Apple ID. I don’t use the Mac App Store. I don’t store photos in the macOS “Photos” application, even locally. I…
590
NYPD can use more than 15,000 cameras to track people using facial recognition
Thousands of volunteers helped map surveillance cameras that the NYPD could use to track people using facial recognition.
591
Supply Chain Attack Using PyPI Packages “Colorslib”, “Httpslib”, and “Libhttps”
The FortiGuard Labs team discovered an attack embedded in three PyPI packages called ‘colorslib’, ‘httpslib’, and “libhttps”. Read our blog to learn more.…
592
I'm shadow banned by DuckDuckGo and Bing
My personal site has zero pages indexed by DuckDuckGo and Bing and even searches for my URL return zero results. This post is a description of the problem and the start of my journey to fix it.
593
MSI's (in)Secure Boot
Before we start, maybe I will quickly explain what Secure Boot is. It is a security feature, which allows our computer to decline booting operating systems that have not been signed by a key that the firmware trusts.
594
WInd3x, the iPod Bootrom exploit 10 years too late
This is a write-up of the wInd3x bootrom exploit affecting iPod Nanos from 3rd gen to 5th gen. A ready-made tool to use this exploit is available at github.com/freemyipod/wInd3x .
595
596
A Visual Guide to SSH Tunnels: Local and Remote Port Forwarding
SSH port forwarding explained in a clean and visual way. How to use local and remote port forwarding. What sshd settings may need to be adjusted. How to memorize the right flags.
597
I hacked Gumroad’s API and broke a bunch of tools
A critical security vulnerability in Gumroad's API allowed anyone to generate unauthorized license keys for paid products without making a purchase.
598
Jump Servers
Today we're going to talk about how jump servers work and how hoop can be a great alternative to them. Jump Servers are nodes that will grant access to your underline infra-structure services. Imagine that someone from your company need to access a database or an application inside your internal infra-structure…
599
Identity thieves bypassed Experian security to view credit reports
Identity thieves have been exploiting a glaring security weakness in the website of Experian , one of the big three consumer credit reporting bureaus. Normally, Experian requires that those seeking a copy of their credit report successfully answer several multiple choice questions about their financial history. But…
600
TouchEn nxKey: A keylogging anti-keylogger solution
TouchEn nxKey is supposed to combat keyloggers. Instead, this application made writing a keylogger extremely simple, allowed attacking banking websites and more.