1651
Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws
Dynamic languages are safe from memory corruptions bugs, right?
New
The latest blog posts to take off on Hacker News. 8,770 posts.
1652
The XAES-256-GCM extended-nonce AEAD
XAES-256-GCM is a new AEAD extended-nonce algorithm designed for high-level APIs and FIPS 140 compliance.
1653
1654
Entrust Certificate Distrust
Posted by Chrome Root Program, Chrome Security Team Update (09/10/2024): In support of more closely aligning Chrome’s planned compliance ...
1655
Cloudflare automatically fixes Polyfill.io for free sites
polyfill.io, a popular JavaScript library service, can no longer be trusted and should be removed from websites
1656
1657
1658
Polyfill supply chain attack hits 100K+ sites
The new Chinese owner of the popular Polyfill JS project injects malware into more than 100 thousand sites.
1659
More Memory Safety for Let's Encrypt: Deploying ntpd-rs
When we look at the general security posture of Let’s Encrypt, one of the things that worries us most is how much of the operating system and network infrastructure is written in unsafe languages like C and C++. The CA software itself is written in memory safe Golang, but from our server operating systems to our…
1660
I found a 1-click exploit in South Korea's biggest mobile chat app
Stealing another KakaoTalk user’s chat messages with a simple 1-click exploit.
1661
GCC's new fortification level: The gains and costs (2022)
Discover the gains and costs of GCC’s enhanced runtime buffer overflow protection. Level 3 _FORTIFY_SOURCE preprocessor macro may detect more buffer overflows, but there’s a cost.
1662
The tiny chip that powers Montreal subway tickets
To use the Montreal subway (the Métro), you tap a paper ticket against the turnstile and it opens. The ticket works through a system called ...
1663
SSH as a Sudo Replacement
A major caveat in tools like sudo and doas for that matter is that they rely on setuid binaries and privilege escalation in order to run commands as root.
1664
Hacking eInk Price Tags (2021)
Dmitry.GR: Wireless picture frames that run for years on batteries
1665
Simple ways to find exposed sensitive information
Code level discussion of web scraping, gray hat automation, growth hacking and bounty hunting
1666
A buffer overflow in the XNU kernel
XNU kernel buffer overflow, introduced in macOS 14.0 and fixed in macOS 14.5.
1667
Reconstructing Public Keys from Signatures
One weird hobby of mine is reasonable properties of cryptographic schemes that nobody promised they do or don’t have. Whether that’s invisible salamanders or binding through shared secr…
1668
1669
The hacking of culture and the creation of socio-technical debt
Culture is increasingly mediated through algorithms. These algorithms have splintered the organization of culture, a result of states and tech companies vying for influence over mass audiences. One byproduct of this splintering is a shift from imperfect but broad cultural narratives to a proliferation of niche groups…
1670
EU Council to Vote on Chat Scanning Proposal on Thursday
🇫🇷 French: Traduction du dossier Chat Control 2.0, stopchatcontrol.fr🇸🇪 Swedish: Chat Control 2.0🇩🇰 Danish: chatcontrol.dk🇳🇱 Dutch: Chatcontrole Table of contents: The End of the Privacy of Digital Correspondence and the End of Anonymous Communication Take action to stop Chat
1671
Off-path TCP hijacking in NAT-enabled Wi-Fi networks
Guest Post: New off-path TCP hijacking attack in Wi-Fi networks that exploits vulnerabilities in the NAT mapping strategies of routers discovered.
1672
Chat Control: Incompatible with Fundamental Rights (2022)
The EU Commission's draft regulation on chat control is currently being negotiated in the European Parliament and the Council of Ministers. With the fight against sexual violence against children, the draft pursues an objective that is essential for the protection of children and their rights and can justify…
1673
Chat Control Must Be Stopped – Now
With its legislative proposal known as “Chat Control,” the EU Commission is trying to establish an unprecedented mass-surveillance apparatus of Orwellian proportions in the European Union. If EU citizens don’t stand up for privacy now, it may be too late.
1674
EU to greenlight Chat Control tomorrow
[Update: Vote has been postponed to Thursday, keep up the pressure!] The Belgian EU Council presidency seems set to have bulk Chat Control searches of our private communications greenlighted by EU governments on Wednesday 19 Thursday 20 June. This confirms concerns that the proponents of Chat Con
1675
Sei pays out $2M bug bounty
In April 2024, I found and reported two critical bugs to Sei Network concerning their layer-1 blockchain. One of these issues impacted the chain’s availability, and the other its integrity. The Sei Foundation awarded me $75,000 and $2,000,000 respectively for these reports.
1676
Mozilla acquires privacy-focused ad tech company Anonym
Mozilla has acquired Anonym, a trailblazer in privacy-preserving digital advertising. This strategic acquisition enables Mozilla to help raise the bar for
1677
What You Get After Running an SSH Honeypot for 30 Days
Discover what 11,599 SSH login attempts reveal after running a honeypot for 30 days. Learn key cybersecurity insights—read now to protect your systems!
1678
Reverse engineering a restaurant pager system
Let's reverse engineer a restaurant pager system I bought off the internet!
1679
Perplexity AI is lying about their user agent
Perplexity AI claims it sends a user agent and respects robots.txt but it absolutely does not
1680
Driving forward in Android drivers
Posted by Seth Jenkins, Google Project ZeroIntroduction Android's open-source ecosystem has ...