1471
Insiders Stealing Instagram Usernames?
My computer on the net
New
The latest blog posts to take off on Hacker News. 8,770 posts.
1472
The sins of the 90s: Questioning a puzzling claim about mass surveillance
Meredith Whittaker, president of the Signal Foundation, gave an interesting talk at NDSS 2024 titled "AI, Encryption, and the Sins of the 90s".
1473
Hacking the T2S+ Out of Fear: Get Lock-In Thermography for Free
Hacking the T2S+ v2 to work on computers, tear it down for the first time online, and play with lock-in thermography as a bonus!
1474
ZombAIs: From Prompt Injection to C2 with Claude Computer Use
A few days ago, Anthropic released Claude Computer Use, which is a model + code that allows Claude to control a computer. It takes screenshots to make …
1475
SELinux bypasses
This post aims at giving an overview of what SELinux is, how it is implemented, and how to bypass it, from the point of view of Android kernel exploitation.
1476
Law Enforcement Undermines Tor
Few weeks ago, the German political magazine Panorama and STRG_F reported that law enforcement agencies infiltrated the Tor network in order to expose criminals. The reporters had access to documents showing four successful deanonymizations. I was given the chance to review some documents. In this post, I am…
1477
Becoming physically immune to brute-force attacks (2021)
Using thermal physics, cosmology, and computer science to calculate password vulnerability to the biggest possible brute-force attack.
1478
Security research on Private Cloud Compute
Private Cloud Compute (PCC) fulfills computationally intensive requests for Apple Intelligence while providing groundbreaking privacy and security protections — by bringing our industry-leading device security model into the cloud. To build public trust in our system, we’re making it possible for researchers to…
1479
Lawsuit challenges Virginia City's use of cameras for warrantless surveillance
NORFOLK, Va.—Today, two Norfolk-area residents teamed up with the Institute for Justice (IJ) to file a federal lawsuit against the city, challenging the constitutionality of […]
1480
The global surveillance free-for-all in mobile ad data
Not long ago, the ability to digitally track someone’s daily movements just by knowing their home address, employer, or place of worship was considered a dangerous power that should remain only within the purview of nation states. But a new lawsuit in a likely constitutional battle over a New Jersey privacy law shows…
1481
Fearless SSH: Short-lived certificates bring Zero Trust to infrastructure
Access for Infrastructure, BastionZero’s integration into Cloudflare One, will enable organizations to apply Zero Trust controls to their servers, databases, Kubernetes clusters, and more. Today we’re announcing short-lived SSH access as the first available feature of this integration.
1482
Rustls Outperforms OpenSSL and BoringSSL
ISRG has been investing heavily in the Rustls TLS library over the past few years. Our goal is to create a library that is both memory safe and a leader in performance. Back in January of this year we published a post about the start of our performance journey. We've come a long way since then and we're excited to…
1483
1484
U.S. border surveillance towers have always been broken
A new bombshell scoop from NBC News revealed an internal U.S. Border Patrol memo claiming that 30 percent of camera towers that compose the agency's "Remote Video Surveillance System" (RVSS) program are broken. Except, this isn't a bombshell. What should actually be shocking is that Congressional leaders are acting…
1485
Apple Passwords’ generated strong password format
This post briefly summarizes part of a talk I gave in 2018. All information in this post has been accessible on YouTube since then. There is no new information or news in this post. On Mastodon recently, jsveningsson@mastodon.social asked me: Having an annoying argument on Threads about Apple generated passwords…
1486
Escaping the Chrome Sandbox Through DevTools
This blog post details how I found CVE-2024-6778 and CVE-2024-5836, which are vulnerabilities within the Chromium web browser which allowed for a sandbox escape from a browser extension.
1487
Should We Chat, Too? Security Analysis of WeChat's Mmtls Encryption Protocol
This report performs the first public analysis of MMTLS, the main network protocol used by WeChat, an app with over one billion users. The report finds that MMTLS is a modified version of TLS, however some of the modifications have introduced cryptographic weaknesses.
1488
We outsmarted CSGO cheaters with IdentityLogger
Learn how IdentityLogger used fingerprinting to combat ban evasion, protecting our CSGO community from relentless cheaters.
1489
MacOS sometimes leaks traffic after system updates
We have found that you could be leaking traffic on macOS after system updates. To our current knowledge a reboot resolves it. We are currently investigating this and will follow up with more information.
1490
FIDO Alliance publishes new spec to let users move passkeys across providers
The FIDO Alliance has published a working draft of a new set of specifications for secure credential exchange that, when standardized and implemented by
1491
ACF has been hijacked
It’s super late at night on Thanksgiving weekend in Canada. I shouldn’t be thinking about weird internet drama, but here we are.
1492
"Begin disabling installed extensions still using Manifest V2 in Chrome stable"
Details of the Manifest V2 phase-out and end of life.
1493
A free and open internet shouldn't come at the expense of privacy
MARK SURMAN, PRESIDENT, MOZILLA Keeping the internet, and the content that makes it a vital and vibrant part of our global society, free and accessible has
1494
European govt air-gapped systems breached using custom malware
ESET Research analyzed two separate toolsets for breaching air-gapped systems, used by a cyberespionage threat actor known as GoldenJackal.
1495
Can you get root with only a cigarette lighter?
Before you can write an exploit, you need a bug. When there are no bugs, we have to get creative—that's where Fault Injection comes in. Fault injection can take many forms, including software-controlled data corruption, power glitching, clock glitching, electromagnetic pulses, lasers, and more.
1496
How to stop advertisers from tracking your teen across the internet
When children turn 13, they age out of the data protections provided by the Children’s Online Privacy Protection Act (COPPA). Then, they become targets for data collection from data brokers that collect their information from social media apps, shopping history, location tracking services, and more.
1497
Mitmproxy 11: Full HTTP/3 Support
We are excited to announce the release of mitmproxy 11, which introduces full support for HTTP/3 in both transparent and reverse proxy modes. We’re also bringing in a ton of DNS improvements that we’ll cover in this blog post.
1498
Perfctl: Stealthy malware targeting Linux servers
Perfctl is particularly elusive and persistent malware employing several sophisticated techniques
1499
EU: Definition of "potential terrorists" opens door to broad information-sharing
EU member states can now collect and share information on “potential terrorists”. This category is based on a new informal definition that was agreed with no democratic scrutiny. While claiming to target those who may engage in political violence, there is potential for far broader application.
1500
FTC Report Confirms: Commercial Surveillance Is Out of Control
A new Federal Trade Commission (FTC) report confirms what EFF has been warning about for years: tech giants are widely harvesting and sharing your personal information to fuel their online behavioral advertising businesses.