151
Container security best practices: Ultimate guide
Container security is critical as companies use them more often for AI workloads and cloud workloads. Learn about 17 container security best practices here.
New
The latest blog posts to take off on Hacker News. 678 posts.
152
SHA-1 'fully and practically broken' by new collision (2020)
Independent security journalism: news and analysis on intrusions, vulnerabilities, AI, policy and the software supply chain, plus video and podcasts.
153
IoT hacking and rickrolling my high school district
This is the story of how I created a botnet of IPTVs to rickroll 10,000+ students for my senior prank.
154
Study reveals scale of data-sharing from Android mobile phones
These vendor-customised Android variants transmit substantial amounts of information to the OS developer and to third parties such as Google, Microsoft, LinkedIn, and Facebook that have pre-installed system apps.
155
Reproducible builds for Debian: a big step forward
This is the second article in the “reproducible builds” series. Previously: Improvements in testing and building: GitLab CI and reproducible builds. In the previous article, Improvements in testing and building: GitLab CI and reproducible builds, we discussed reproducible builds and our...
156
The Microsoft MFA system almost brought me to a nervous breakdown
Update 12/10/21, 10:15 UTC: I never imagined this post would reach the front page on Hacker News and gather so much support. Thank you all…
157
Farm equipment security at DEF CON 29
At DEF CON 29, a security researcher exposed the vulnerabilities of farm equipment manufacturers.
158
Hacking YouTube with a MP4
Keyboard Warrior, Breaking software is just finding unintended features, right?
159
European Parliament Voted to Ban Remote Biometric Surveillance
It’s not actually banned in the EU yet—the legislative process is much more complicated than that—but it’s a step: a total ban on biometric mass surveillance. To respect “privacy and human dignity,” MEPs said that EU lawmakers should pass a permanent ban on the automated recognition of individuals in public spaces…
160
Malwarebytes' privacy VPN is Mullvad in a shady trenchcoat
Personal blog of Julien (jvoisin) Voisin
161
Incenser, or how NSA and GCHQ are tapping internet cables (2014)
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
162
Why Did Satoshi Decide to Use Secp256k1 Instead of Secp256r1?
Secp256k1 and secp256r1 are two commonly used curves. Hyperledger / Fabric developed by IBM is using secp256r1 while Bitcoin is using secp256k1. What is the difference between these two and why did Satoshi decide to use secp256k1 which is considered as a surprising choice at the time?
163
SSH Tunneling Explained
SSH tunneling transports data streams within an existing SSH session. This post explains different tunneling techniques and features as supported by OpenSSH.
164
Android wallpaper images can threaten privacy
Android 12's Material You could risk your privacy. Learn protective measures with our insights.
165
YubiKey Bio Series
The YubiKey Bio Series delivers secure second factor and passwordless logins for desktop-based FIDO-supported services and applications.
166
What is BGP? – BGP routing explained
Border Gateway Protocol (BGP) is the routing protocol for the Internet. Much like the post office processing mail, BGP picks the most effecient routes for delivering Internet traffic.
167
What Happened to Facebook, Instagram, and WhatsApp?
Facebook and its sister properties Instagram and WhatsApp are suffering from ongoing, global outages. We don’t yet know why this happened, but the how is clear: Earlier this morning, something inside Facebook caused the company to revoke key digital records that tell computers and other Internet-enabled devices how to…
168
Security Best Practices for Fintech Application Development
Learn how to build and manage your card program using Marqeta's guides and API reference documentation.
169
Web Scrapers Claim to Sell Personal Data on Facebook Users on a Hacker Forum
Data on over 1.5 billion Facebook users is being sold on a hacking-related forum, enabling cybercriminals advertisers to target users.
170
171
The Rise of One-Time Password Interception Bots
In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords (OTPs) that many websites require as a second authentication factor in addition to passwords. That service quickly went offline, but new research reveals a number of competitors have since…
172
Always-on Processor magic: How Find My works while iPhone is powered off
Wireless and firmware hacking, PhD life, Technology
173
Kraken Security Labs Identifies Vulnerabilities in Commonly Used Bitcoin ATM
Bitcoin ATMs offer a convenient and friendly way for consumers to purchase cryptocurrencies. That ease of use can sometimes come at the expense of security. Kraken Security Labs has uncovered multiple hardware and software vulnerabilities in a commonly used cryptocurrency ATM: The General Bytes BATMtwo (GBBATM2)…
174
Private censorship is not the best way to fight hate or defend democracy (2018)
From Cloudflare’s headline-making takedown of the Daily Stormer last autumn to YouTube’s summer restrictions on LGBTQ content, there's been a surge in “voluntary” platform censorship. Companies—under pressure from lawmakers, shareholders, and the public alike—have ramped up restrictions on speech,...
175
Apple AirTag Bug Enables ‘Good Samaritan’ Attack
The new $30 AirTag tracking device from Apple has a feature that allows anyone who finds one of these tiny location beacons to scan it with a mobile phone and discover its owner’s phone number if the AirTag has been set to lost mode. But according to new research, this same feature can be abused to redirect the Good…
176
177
Fail2ban – Remote Code Execution
Securitum is a pure pentesting company specialising in the security of IT systems. We have experience in performing security audits (including penetration tests) - mainly for financial/e-commerce/industrial sectors. We have performed penetration tests and cyber security services for leading European banks (see…
178
DoS attacks against my online game
DDraceNetwork is an open source online game I’ve been running since 2013 with a community of volunteers. The game is available for free, I’m hosting servers for it in many countries around the world so that we have trusted official ranks . The servers are paid for by donations , which I stop collecting once the cost…
179
180
Developers fix multitude of vulnerabilities in Apache HTTP Server
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.