8371
New
The latest blog posts to take off on Hacker News. 8,776 posts.
8372
CNN, NYTimes, Mashable all vulnerable to XSS
Pretending innocence, I ask why all these high profile websites have their homepages covered in spinning images? CNN (screenshot) The New York Times (screenshot) Mashable (screenshot) Fox News (screenshot) Okay, obviously enough, I’m messing with them. But how can I do that? The answer is cross site scripting (“XSS”)…
8373
8374
Jwz: Google's pseudonym support "obvious bullshit"
In a shamefully credulous statement, they say: Proponents of pseudonymity scored a major victory today, when Google executive Vic Gundotra revealed at the Web 2.0 Summit that social networking service Google+ will begin supporting pseudonyms and other types of identity. According to Mashable, Google+ will be "adding…
8375
Secret iOS business; what you don’t know about your apps
In the beginning, there was the web and you accessed it though the browser and all was good. Stuff didn’t download until you clicked on something; you expected cookies to be tracking you and you always knew if HTTPS was being used. In general, the casual observer had a
8376
Google to default to SSL version for logged in users
Insights from Googlers into our products, technology, and the Google culture
8377
8378
8379
8380
Hiding your data in plain sight: USB hardware hiding
This article will describe the possibility of hiding data in any kind of USB hardware. Even though USB data carriers come in various sizes and forms, which already sometimes makes them hard to recognize, this approach could even make it worse. Any USB device could be a data carrier and thus from a forensics point of…
8381
German Chaos Computer Club analyzes and releases government malware
The largest European hacker club, "Chaos Computer Club" (CCC), has reverse engineered and analyzed a "lawful interception" malware program used by German police forces. It has been found in the...
8382
8383
Isaac Asimov on Security Theatre.
A great find: In his 1956 short story, “Let’s Get Together,” Isaac Asimov describes security measures proposed to counter a terrorist threat: “Consider further that this news will leak out as more and more people become involved in our countermeasures and more and more people begin to guess what we’re doing. Then…
8384
8385
8386
Root access to MySQL.com sold for $3k - now serving malware
A security firm revealed today that mysql.com , the central repository for widely-used Web database software, was hacked and booby-trapped to serve visitors with malicious software. The disclosure caught my eye because just a few days ago I saw evidence that administrative access to mysql.com was being sold in the…
8387
MySQL.com currently Hacked (and serving javascript malware)
It looks like the MySQL.com website is currently hacked and compromised with a JavaScript malware (and serving malware to anyone visiting it). Our scanner identified…
8388
How to Force Facebook into Handing Over their Secret Tracking Data
According to European data protection law every individual has the right to get a copy of all personal data a company holds about him (right to access). This law is applicable to Facebook too. Every user with a residence outside of the US and Canada has a contract with “Facebook Ireland Limited”, based in Dublin…
8389
8390
Chrome Privacy
Dave Winer ends an otherwise quite reasonable piece about his concern at Facebook's
8391
OnStar Begins Spying On Customers’ GPS Location For Profit
I canceled the OnStar subscription on my new GMC vehicle today after receiving an email from the company about their new terms and conditions. While most people, I imagine, would hit the delete button when receiving something as exciting as new terms and conditions, being the nerd sort, I decided to have a personal…
8392
8393
Iran blocks Tor; Tor releases same-day fix
The short version: Tor relays and bridges should upgrade to Tor 0.2.2.33 or Tor 0.2.3.4-alpha so...
8394
UTorrent.com compromised, malware added to installer
This morning on 9/13/2011 at approximately 4:20 a.m. Pacific Daylight Time (UTC -7), the uTorrent.com and BitTorrent.com Web servers were compromised. Our standard Windows software download was replaced with a type of fake antivirus “scareware” program. (UPDATE: See below for removal instructions.) Just…
8395
Searching for "semicolon injection" bugs in embedded Linux devices
Introduction I recently bought a D-Link DCS-2121 surveillance camera. This is good stuff: Megapixel camera + microphone + speaker WiFi,...
8396
8397
8398
DigiNotar Damage Disclosure (with full list of issued certs)
About an hour ago I was contacted by the Dutch Government with more details about the DigiNotar...
8399
Facebook doesn't like privacy countermeasures
German tech-news site Heise changed their "Like" buttons to be locally-hosted images that only transform into real Facebook "Like" buttons once you click them -- meaning that if you don't click anything, Facebook can't track you, and that actually "liking" the page requires two clicks. (Also presumably meaning that…
8400
DigiNotar root CA trust removal follow-up
Earlier this week we revoked our trust in the DigiNotar certificate authority from all Mozilla software. This is not a temporary suspension, it is a complete removal from our trusted ...