1531
Our Git Hash Bug
Things this developer thinks might be interesting to you.
New
The latest blog posts to take off on Hacker News. 8,770 posts.
1532
Hacking misconfigured AWS S3 buckets: A complete guide
AWS S3 (Simple Storage Service) buckets are a popular storage service used by software companies and organizations to store public as well as sensitive data. However, the implementation of this servic...
1533
Nobody Cares About Security
Nobody cares about security. There. I said it. I said the thing everyone feels, some people think, but very few have the temerity to say out loud. But before you call me...
1534
1535
"Unstripping" binaries: Restoring debugging information in GDB with Pwndbg
GDB loses significant functionality when debugging binaries that lack debugging symbols (also known as “stripped binaries”). Function and variable names become meaningless addresses; setting breakpoints requires tracking down relevant function addresses from an external source; and printing out structured values…
1536
Baiting the bot
LLM chatbots can be engaged in endless "conversations" by considerably simpler text generation bots. This has some interesting implications.
1537
The "email is authentication" pattern
By Ruben Schade in Eora/Sydney, Australia.
1538
Cracking an old ZIP file to help open source the ANC's "Vula" secret crypto code
It's not often that you find yourself staring at code that few people have ever seen, code that was an important part in bringing down the a...
1539
Keyhole – Forge own Windows Store licenses
By WitherOrNot
1540
The Insecurity of Debian
The difference in security defaults between Debian and Red Hat.
1541
EUCLEAK Side-Channel Attack on the YubiKey 5 Series
Download the Writeup Illustration Romain Flamand – Flamingo Studio – flamandromain@gmail.com Abstract Secure elements are small microcontrollers whose main purpose is to generate/store secrets and then execute cryptographic operations. They undergo the highest level of security evaluations that exists (Common…
1542
IPMI
I am making steady progress towards moving the Computers Are Bad enterprise cloud to its new home, here in New Mexico. One of the steps in this process is, of course, purchasing a new server... the current Big Iron is getting rather old (probably about a decade!) and here in town I'll have the rack space for more…
1543
Owners of 1-Time Passcode Theft Service Plead Guilty
Three men in the United Kingdom have pleaded guilty to operating otp[.]agency , a once popular online service that helped attackers intercept the one-time passcodes (OTPs) that many websites require as a second authentication factor in addition to passwords.
1544
OAuth from First Principles
I've wanted to write a blog post for everyone who learns things the same way that I do; by trying to break them. I'll start off with an awfully flawed implementation that authorizes a user with a 3...
1545
1546
I'm blocking connections from AWS to my on-prem services
The direct result of bulletproof infrastructure / cloud providers which are "too big to fail" is the balkanized internet . I don't think this has fully come to pass, but it might be starting to happen or might come to pass soon.
1547
Firewall rules: not as secure as you think
A post outlining tricks for firewall privilege escalation
1548
Bypassing airport security via SQL injection
We discovered a serious vulnerability in the Known Crewmember (KCM) and Cockpit Access Security System (CASS) programs used by the Transportation Security Administration.
1549
Chrome is entrenching third-party cookies that will mislead users
Related Website Sets is a user-hostile weakening of the Web's privacy model, plainly designed to benefit websites and advertisers, to the detriment of user privacy.
1550
1551
Thoughts on the Durov Arrest
Today we learn that Pavel Durov, founder of the popular messaging app Telegram, has been arrested as his private jet landed in France. Early indications are that the arrest stems from Telegram̵…
1552
Vulnerabilities show why STARTTLS should be avoided if possible (2021)
Guest Post: Study finds more than 40 STARTTLS-related security flaws in many different software products, both client-side and server-side.
1553
New 0-Day Attacks Linked to China's 'Volt Typhoon'
Malicious hackers are exploiting a zero-day vulnerability in Versa Director , a software product used by many Internet and IT service providers. Researchers believe the activity is linked to Volt Typhoon , a Chinese cyber espionage group focused on infiltrating critical U.S. networks and laying the groundwork for the…
1554
Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US
Met deze test controleren we of u een mens bent. Hiermee voorkomen we ongeoorloofd gebruik van deze dienst.
1555
Is Telegram really an encrypted messaging app?
This blog is reserved for more serious things, and ordinarily I wouldn’t spend time on questions like the above. But much as I’d like to spend my time writing about exciting topics, som…
1556
How de-Googled is Lineage OS?
Lineage OS is based on the Android Open-Source Project, whose primary maintainer is Google. To what extent can it be considered Google-free?
1557
Birds aren't real – how to create your own "bird"
Did you know that birds aren't real? They are actually mobile devices that have cameras and microphones to maintain surveillance by the government. You may be asking yourself why they do not just use the cell phones in everyone's pocket; hey, I don't know; I don't make the rules.Now that I have completely destroyed my…
1558
Firewalling your code
When writing code, you can call any function as long as it’s public, and similarly, you can access any object’s public properties or methods. Usually, access to code is all or none – a piece of code can be either public or private. Lately, I’ve been thinking about ways to implement more fine-grained access controls…
1559
The Cryptographic Doom Principle (2011)
When it comes to designing secure protocols, I have a principle that goes like this: if you have to perform any cryptographic operation before verifying the MAC on a message you’ve received, it will somehow inevitably lead to doom.
1560
OpenSSH Backdoors
Imagine this: an OpenSSH backdoor is discovered, maintainers rush to push out a fixed release package, security researchers trade technical details on mailing lists to analyze the backdoor code. Speculation abounds on the attribution and motives of the attacker, and the tech media pounces on the story. A near miss