181
New
The latest blog posts to take off on Hacker News. 473 posts.
182
How widely used are security-based HTTP response headers?
In this blog I look at how widespread the usage of common security based HTTP response headers are in the Alexa Top 1 Million most visited sites.
183
184
Handling App Transport Security in iOS 9
The rollout of iOS 9 is expected to come this Fall and will introduce a new privacy feature called App Transport Security (ATS) to enforce ...
185
186
Important Notice Regarding Public Availability of Stable Patches
grsecurity is the only drop-in Linux kernel replacement offering high-performance, state-of-the-art exploit prevention against both known and unknown threats.
187
Who Hacked Ashley Madison?
AshleyMadison.com , a site that helps married people cheat and whose slogan is “Life is Short, have an Affair,” recently put up a half million (Canadian) dollar bounty for information leading to the arrest and prosecution of the Impact Team — the name chosen by the hacker(s) who recently leaked data on more than 30…
188
189
AT&T Hotspots: Now with Advertising Injection
While traveling through Dulles Airport last week, I noticed an Internet oddity. The nearby AT&T hotspot was fairly fast—that was a pleasant surprise.
190
191
Here’s what Ashley Madison members have told me
I found myself in somewhat of a unique position last week: I’d made the Ashley Madison data searchable for verified subscribers of Have I been pwned? [https://haveibeenpwned.com/] (HIBP) and now – perhaps unsurprisingly in retrospect – I was being inundated with email. I mean hundreds of emails every day
192
Backdooring JavaScript using minifier bugs
In addition to unforgettable life experiences and personal growth, one thing I got out of DEF CON 23 was a copy of POC||GTFO 0x08 from Travis Goodspeed. The coolest article I’ve read so far in it is “Deniable Backdoors Using Compiler Bugs,” in which the authors abused a pre-existing bug in CLANG to create a backdoored…
193
Exploring the Hacker Tools of Mr. Robot
Discover the tools used in the Mr Robot television show to break into target computers. Then download, play and build your security knowledge.
194
Obama Administration Supports Privacy-Invasive “Cybersecurity” Bill
Right before Congress left for its annual summer vacation the Obama Administration endorsed the Senate Intelligence Committee's Cybersecurity Information Sharing Act (CISA). EFF opposes the bill because its vague definitions, broad legal immunity, and new spying powers allow for a tremendous amount...
195
Tarsnap exploit bounty
Most bugs are straightforward, but occasionally one comes up which is not so clear in its impact. Such is the case with a bug which is fixed in tarsnap 1.0.36 . This bug causes the NUL string termination byte to overflow the heap-allocated buffer used for paths of objects examined as tarsnap traverses a directory…
196
Analysis of PS4's security and the state of hacking
Since there haven't been any major public announcements regarding PS4 hacking for a long time now, I wanted to explain a bit about how far PS4 hacking has come, and what is preventing further progression.
197
The Ashley Madison Database Was Leaked
Many news sites and blogs are reporting that the data stolen last month from 37 million users of AshleyMadison.com — a site that facilitates cheating and extramarital affairs — has finally been posted online for the world to see. In the past 48 hours, several huge dumps of data claiming to be the actual AshleyMadison…
198
199
Decertifying the worst voting machine in the US
On Apr 14 2015, the Virginia State Board of Elections immediately decertified use of the AVS WinVote touchscreen Direct Recording Electronic (DRE) voting machine. This seems pretty minor, but it received a tremendous amount of pushback from some local election officials. In this post, I’ll explain how we got to that…
200
Canada's Quiet Weakening of Communications Encryption
This article outlines some of the federal government of Canada’s successful and unsuccessful attempts to weaken encryption standards.
201
The network is hostile
Yesterday the New York Times and ProPublica posted a lengthy investigation based on leaked NSA documents, outlining the extensive surveillance collaboration between AT&T and the U.S. government…
202
Beware of sudo on OS X
There's a little kerfuffle going on over on HN about a newly discovered local root exploit on OS X 10.10.5 , so I thought this might be a g...
203
204
Black Hat USA 2015: The full story of how that Jeep was hacked
Recently we wrote about Jeep Cherokee hack incident. At Black Hat security researchers Charlie Miller and Chris Valasek finally explained, how exactly that hack was done
205
Android libstagefright still exploitable
Update (2015-08-13 1:16pm CST): We’ve been in contact with Zimperium and are working with them to provide coverage for detection of this flaw through their Stagefright Detector app. They have been very responsive (more so than the affected vendor) and we plan to alert them of similar flaws we’ve recently discovered…
206
Introducing Docker Content Trust
Docker is a founding member of the Blueprint Alliance, a 12-company reference architecture for securing AI agents, built around four governance questions.
207
Firefox Under Fire: Anatomy of latest 0-day attack
The recent Firefox attacks are an example of active in-the-wild exploitation of a serious software vulnerability.
208
Thunderstrike 2: Mac firmware worm details
Collection of my projects and hacks.
209
210
