1381
Right to root access
right to repair laws should include provisions requiring manufacturers to unlock a device's bootloader (to provide root access) upon consumer request.
New
The latest blog posts to take off on Hacker News. 8,770 posts.
1382
Backdooring Your Backdoors – Another $20 Domain, More Governments
After the excitement of our .MOBI research, we were left twiddling our thumbs. As you may recall, in 2024, we demonstrated the impact of an unregistered domain when we subverted the TLS/SSL CA process for verifying domain ownership to give ourselves the ability to issue valid and trusted TLS/
1383
Homomorphic encryption in iOS 18
A mathematical miracle enables Apple's servers to process your photos while never knowing anything about them
1384
WorstFit: Unveiling Hidden Transformers in Windows ANSI
📌 This is a cross-post from DEVCORE. The research was first published at Black Hat Europe 2024. Personally, I would like to thank splitline, the co-author of this research & article, whose help
1385
A day in the life of a prolific voice phishing crew
Besieged by scammers seeking to phish user accounts over the telephone, Apple and Google frequently caution that they will never reach out unbidden to users this way. However, new details about the internal operations of a prolific voice phishing gang show the group routinely abuses legitimate services at Apple and…
1386
Online Behavioral Ads Fuel the Surveillance Industry
Each time you see a targeted ad, your personal information is exposed to thousands of advertisers and data brokers through a process called “real-time bidding” (RTB). This process does more than deliver ads—it fuels government surveillance, poses national security risks, and gives data brokers easy access to your…
1387
Cascading Spy Sheets: Exploiting the Complexity of Modern CSS for Fingerprinting
In an attempt to combat user tracking, both privacy-aware browsers (e.g., Tor) and email applications usually disable JavaScript. This effectively closes a major angle for user fingerprinting. However, recent findings hint at the potential for privacy leakage through selected Cascading Style Sheets (CSS) features…
1388
1389
A story on home server security
Happy New Year! Or so I thought. After a refreshing Christmas vacation with my family, I was stashing something away in our storage room when I noticed the server fan running at maximum speed. This was very unexpected, considering my server is powered by an Intel i3 and should handle all the light tasks I run quite…
1390
Remote code execution via MIDI messages
Blog post about a reverse engineering project
1391
1392
I still don't think companies serve you ads based on your microphone
One of my weirder hobbies is trying to convince people that the idea that companies are listening to you through your phone’s microphone and serving you targeted ads is a …
1393
1394
1395
Why does storing 2FA codes in your password manager make sense?
Modern login systems require a second factor (2FA) to log in, in addition to the standard username and password combination. A Time-based one-time password (TOTP) as a 6-digit number is often used. Password managers like [1Password](https://1password.com/), [KeePass (or respective forks)](https://keepass.info/) and…
1396
Déjà vu: Ghostly CVEs in my terminal title
As I've spoken and written about all modern terminals are actually "emulating" something dating from the 1970s.
1397
U.S. Army Soldier Arrested in AT&T, Verizon Extortions
Federal authorities have arrested and indicted a 20-year-old U.S. Army soldier on suspicion of being Kiberphant0m , a cybercriminal who has been selling and leaking sensitive customer call records stolen earlier this year from AT&T and Verizon . As first reported by KrebsOnSecurity last month, the accused is a…
1398
Colliding with the SHA prefix of Linux's initial Git commit
Or, how to break all the tools that parse the "Fixes:" tag Kees Cook There was a recent discussion about how Linux's "Fixes" tag, which ...
1399
Dumping Memory to Bypass BitLocker on Windows 11
Memory-Dump-UEFI is a UEFI application for dumping the contents of RAM.
1400
Personal Mail Server on OpenBSD (2019)
I will use this place to relate my geeky adventures in the world of gnu/linux, bsd, the internets, and other important things like windows managers and pretty colors. Basically, it's a place to expose and share with the world things I do on my computer.
1401
Finding and exploiting hidden features of Animal Crossing's NES emulator (2018)
While looking for ways to activate the developer menus left over in Animal Crossing, including the NES emulator game selection menu, I found an interesting feature that exists in the original game that was always active, but never used by Nintendo. In addition to the NES/Famicom games that can be obtained in-game, it…
1402
Why it's hard to trust software, but you mostly have to anyway
My long-time collaborator Richard Barnes [1] used to say that "in security, trust is a four letter word" , and yet the dominant experience of using any software-based system—which is, you know, pretty much anything electronic—is trusting the manufacturer. Not only is there no meaningful way to determine what software…
1403
Apple Photos phones home on iOS 18 and macOS 15
This morning while perusing the settings of a bunch of apps on my iPhone, I discovered a new setting for Photos that was enabled by default: Enhanced Visual Search. (I manually disabled it before taking the screenshot below.)
1404
How to Create HTML/ZIP/PNG Polyglot Files
Learn How to Create HTML/ZIP/PNG Polyglot Files!
1405
1406
Narrative Jailbreaking for Fun and Profit
Posted on Monday 23 Dec 2024. 1,634 words, 1 link. By Matt Webb.
1407
Fighting spam with Haskell at Meta (2015)
Visit the post for more.
1408
1409
Exploiting McDonald's APIs to hijack deliveries and order food for a penny
A series of API flaws in McDelivery India made it possible to order food for a penny, hijack other people’s delivery orders, view user information, and more.
1410
Alignment faking in large language models
A paper from Anthropic's Alignment Science team on Alignment Faking in AI large language models