2251
New
The latest blog posts to take off on Hacker News. 8,770 posts.
2252
2253
SMS phishers harvested phone numbers, shipment data from UPS tracking tool
The United Parcel Service (UPS) says fraudsters have been harvesting phone numbers and other information from its online shipment tracking tool in Canada to send highly targeted SMS phishing (a.k.a. “smishing”) messages that spoofed UPS and other top brands. The missives addressed recipients by name, included details…
2254
Is Google reCAPTCHA GDPR Compliant?
Achieve engineered efficiency, uncompromising quality, and long-term stability with our software solutions. We optimize your processes, ensure resilience, and support your growth—so you can focus on what matters most.
2255
French govt. says users of uBlock Origin, Signal etc. are potential terrorists
This article was written on the basis of information related to the so-called "8 December" case (see the footnotes for a global overview of the case, we focus on the "numerical part" of it in this article<fn>For a summary of the 8 December affair see in particular the testimonies available in thi
2256
Did I receive fraudulent DMCA takedowns?
I received 3 DMCA takedown emails today, covering 7350 URLs on my hardbin.com IPFS gateway. The URLs were allegedly serving infringing copies of books. The strange part is that of those 7350 URLs, during the time for which I have nginx logs, none of them have ever been accessed , and of the ones that I checked, none…
2257
Top Mental Health and Prayer Apps Fail at Privacy, Security (2022)
Despite dealing with issues like depression, suicide, domestic violence, and PTSD, these apps share data freely and raise many security concerns
2258
Mullvad Leta: A search engine used in the Mullvad Browser
Online privacy isn't just about a VPN. That’s why we have developed the Mullvad Browser.
2259
2260
We tried to book a train ticket and ended up with a 245k records data breach
Dieser Artikel ist auch auf deutsch erschienen To celebrate Franco-German friendship, German Transport Minister Wissing and his French counterpart Beaune came up with something special: 30,000 free Interrail tickets per country for travel in Germany and France for young adults between 18 and 27. Codename: “Passe…
2261
I don't trust Signal
I don't trust Signal because it pretends to be things which it provably isn't and forces use of their controlled the network. This means that if Signal wanted to, they could intercept messages. In this article I show receipts, that while each individual issue is not back-breaking: casts huge doubts to me on if i…
2262
Swing VPN app is a DDoS botnet
tldr: Swing VPN is using its user base to DDOS sites using its users as a an attack botnet. Introduction It all started with a friend of mine complaining that his phone was doing a request to a specific app every few seconds. Initial assumption was that the phone was infected with a virus but a 2 minute investigation…
2263
Port forwarding
At AzireVPN, we are dedicated to providing our users with advanced features that enhance their online experience. We are thrilled to announce the launch of our latest addition: Port forwarding. In this blog post, we will delve into what Port forwarding is and how it can be leveraged to open
2264
Put an io_uring on it – Exploiting the Linux Kernel (2022)
Put an io_uring on it - Exploiting the Linux Kernel - chompie at the bits
2265
2266
Learnings from kCTF VRP's 42 Linux kernel exploits submissions
Tamás Koczka, Security Engineer In 2020 , we integrated kCTF into Google's Vulnerability Rewards Program (VRP) to support researchers evalu...
2267
Recovering secret keys from devices using video footage of their power LED
Exploiting a Video Camera's Rolling Shutter to Recover Secret Keys from Devices Using Video Footage of Their Power LED
2268
I may be the only evil (bit) user on the internet (2015)
Almost every year a joke RFC is made on April 1st (these have caught on so well, that it’s now common to see more than one of these every year), or April Fool’s Day, and some of them are pretty great. Here are some of my favourites:
2269
NVD Damage Continued
There is something about having your product installed in over twenty billion instances all over the world and even out of the globe. In my case it helps me remain focused on and committed to working on the security aspects of curl. Ideally, we will never have our heartbleed moment. Security is also a generally ……
2270
Hacking root EPP servers to take control of zones
Finding vulnerabilities in global domain infrastructure to take control of ccTLD zones. Vulnerabilities in EPP
2271
Every Signature Is Broken: Insecurity of Microsoft Office’s Ooxml Signatures
Simon Rohlmann, Vladislav Mladenov, Christian Mainka, Daniel Hirschberger, and Jörg Schwenk, Ruhr University Bochum
2272
Desktop Linux Hardening (2022)
Linux is not a secure desktop operating system. However, there are steps you can take to harden it, reduce its attack surface, and improve its privacy. Before we start… Some of the sections will include mentions of unofficial builds of packages like linux‑hardened, akmod, hardened_malloc, and so on. These are not…
2273
The Dutch government wants automatic permission to target victims of hackers
This is a mirror of the original about:intel post, since the about:intel server is sadly sometimes overloaded. Also do read the opposing view from Jan-Jaap Oerlemans and the reflection by Lotte Houwing The Dutch government is proposing adding a lex specialis to its existing intelligence and security services act. This…
2274
2275
CS:GO: From Zero to 0-Day
We identified three independent remote code execution (RCE) vulnerabilities in the popular Counter-Strike: Global Offensive game. Each vulnerability can be triggered when the game client connects to our malicious python CS:GO server. This post details our journey through the CS:GO binary and conducts a technical deep…
2276
Barracuda urges replacing, not patching, its email security gateways
It’s not often that a zero-day vulnerability causes a network security vendor to urge customers to physically remove and decommission an entire line of affected hardware — as opposed to just applying software updates. But experts say that is exactly what transpired this week with Barracuda Networks , as the company…
2277
I'm Not Invidious
TheFrenchGhosty's Blog
2278
AI browser extensions are a security nightmare
AI-powered browser extensions come with alarming security risks, but most companies still don't have policies for how their employees can use them.
2279
Another cluster of potentially malicious Chrome extensions
I discovered a cluster of at least 109 extensions in Chrome Web Store. A few are committing affiliate fraud or spying, most are simply hoarding overly wide privileges before abusing them.
2280
Tailscale doesn't want your password
Tailscale ditches passwords for passkeys, offering a secure, phishing-resistant, and convenient way to authenticate. Learn how passkeys work, why they’re better than passwords, and how to set them up on your tailnet.