571
New
The latest blog posts to take off on Hacker News. 679 posts.
572
Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit
Finding and exploiting bugs in the Xbox 360 hypervisor to create the "Bad Update" exploit.
573
Speedrunners are vulnerability researchers, they just don't know it yet
Video game enthusiasts are developing experience in the cybersecurity industry by accident. Discover how gaming skills can translate into intriguing careers.
574
575
Towards a test suite for TOTP codes
Because I'm a massive nerd, I actually try to read specification documents. As I've ranted ad nauseam before, the current TOTP spec is irresponsibly obsolete. The three major implementations of the spec - Google, Apple, and Yubico - all subtly disagree on how it should be implemented. Every other MFA app has their own…
576
What, if anything, should I do about using Mozilla's Firefox
I have used it for a long time - 20 years now, including for a while the IceWeasel variant - and I like it as a browser.
577
Why can't we screenshot frames from DRM-protected video on Apple devices?
This “feature” accomplishes nothing of value for anyone, including the streaming services, but imposes a massive (and for most people, confusing and frustrating) hindrance on honest people simply trying to easily capture high-quality (as opposed to, say, using their damn phone to take a photograph of their reflective…
578
Xcode constantly phones home
Building StopTheMadness Pro in Xcode is usually very fast, because my project doesn't use any Swift. It's a combination of Objective-C, which compiles much more quickly than Swift, and JavaScript, which doesn't need to be compiled. However, sometimes the builds were very slow for some strange reason. Checking the…
579
Google does not want rights to things you do using Chrome (2008)
Alright, I’ve got another conspiracy theory misconception to dispel. :) After reading through the Chrome Terms of Service, some people are worried that Google is trying to assert rights on ev…
580
An update on Mozilla's terms of use for Firefox
On Wednesday we shared that we’re introducing a new terms of use (TOU) and privacy notice for Firefox. Since then, we’ve been listening to some of our
581
How to gain code execution on hundreds of millions of people and popular apps
how to gain code execution on millions of people and hundreds of popular apps
582
Another Conflict Between Privacy Laws and Age Authentication–Murphy v Confirm ID
This opinion is a routine ruling over TOS formation and whether disputes must go to arbitration. However, before I dig into that question, I need to note the case’s chilling implications. * * * This case involves the Adult Friend...
583
Kaspersky exposes hidden malware on GitHub stealing personal data
Kaspersky Global Research & Analysis Team (GReAT) discovered hundreds of open source repositories with multistaged malware targeting gamers and cryptoinvestors within a new campaign that was dubbed by Kaspersky as GitVenom. The infected projects include an automation instrument for interacting with Instagram accounts…
584
Turning my ESP32 into a DNS sinkhole to fight doomscrolling
A fun project that I learned a lot from.
585
Github scam investigation: Thousands of “mods” and “cracks” stealing data
While looking through the articles on a "social engineering" themed forum I discovered a relatively new scam scheme that shocked me. People create thousands of GitHub repositories with all sorts of things - from Roblox and Fortnite mods to "cracked" FL Studio and Photoshop. As soon as you download and
586
US authorities can see more than ever, with Big Tech as their eyes
Big Tech companies - Apple, Google, and Meta - have built a mass surveillance machine that the government can easily tap into.
587
The need for memory safety standards
For decades, memory safety vulnerabilities have been at the center of various security incidents across the industry, eroding trust in technology and costing billions. T…
588
Introducing a terms of use and updated privacy notice for Firefox
UPDATE: We’ve seen a little confusion about the language regarding licenses, so we want to clear that up. We need a license to allow us to make some of t
589
Certificate Transparency in Firefox
Certificate Transparency (CT) has been one of the biggest advancements in web security, keeping users safe from threats such as certificate fraud and…
590
I Went to SQL Injection Court
Chicago argued that answering a FOIA request with a database query means creating a new record. Matt Chapman sued, I wound up on the stand explaining SQL, and now there's a bill to fix it.
591
Xcode Constantly Phones Home
Building StopTheMadness Pro in Xcode is usually very fast, because my project doesn't use any Swift. It's a combination of Objective-C, which compiles much more quickly than Swift, and JavaScript, which doesn't need to be compiled. However, sometimes the builds were very slow for some strange reason. Checking the…
592
593
'Impossible-to-hack' security turns out to be no security
Teammate App had a publicly exposed database and told me to stop harassing them after I emailed them about it.
594
595
It is no longer safe to move our governments and societies to US clouds
The very short version: it is madness to continue transferring the running of European societies and governments to American clouds. Not only is it a terrible idea given the kind of things the “King of America” keeps saying, the legal sophistry used to justify such transfers, like the nonsense letter the Dutch cabinet…
596
The $1.5B Bybit Hack
The $1.5B Bybit Hack demonstrates how the Era of Operational Security Failures has arrived, and most cryptocurrency companies are not prepared for its implications.
597
I found a backdoor into my bed
Eight Sleep smart bed found to contain an exposed AWS key and a likely backdoor that allowed engineers to remotely access users' beds
598
An inside look at NSA tactics, techniques and procedures from China's lens
Since I reside in a Five Eyes country (Australia) and have publicly presented four cases I led on China’s APT41 attacking organisations in ASEAN , particularly concerning China’s cyber and political strategies, I was curious to explore what China publishes about Five Eyes operations. This led me down a rabbit hole of…
599
Multiple Russia-aligned threat actors actively targeting Signal Messenger
Russia state-aligned threat actors target Signal Messenger accounts used by individuals of interest to Russia's intelligence services.
600
Pi-hole v6
We’ve integrated a new REST API and embedded web server directly into the pihole-FTL binary. This eliminates the need for lighttpd and PHP , reducing the installation footprint and boosting performance. The new API also offers server-side pagination for the query log, ensuring a faster and more responsive interface.