2281
“Fractureiser” malware in popular Minecraft mods and modpacks
Malware is being distributed through Minecraft mods and modpacks mainly through CurseForge
New
The latest blog posts to take off on Hacker News. 8,770 posts.
2282
2283
Phishing Darknet Users for Bitcoins
Writeup of a tool for creating bitcoin stealing phishing clones of onion services on large scale
2284
2285
WFH – Watched from Home: Office 365 and workplace surveillance creep (2022)
Imagine your performance at work was assessed directly from the amount of e-mails sent, the amount of time consumed editing a document, or the time spent in meetings or even moving your mouse. This may sound ludicrous but your boss might be doing exactly that.
2286
GitHub Private Repos Considered Private-Ish
This week, we discovered that GitHub.com’s RSA SSH private key was briefly exposed in a public GitHub repository.
2287
Calling time on DNSSEC: The costs exceed the benefits
I’m calling time on DNSSEC. Last week, prompted by a change in my DNS hosting setup, I began removing it from the few personal zones I had signed. Then this Monday the .nz ccTLD experienced a multi-day availability incident triggered by the annual DNSSEC key rotation process. This incident broke several of my unsigned…
2288
System76's coreboot open firmware manages to disable Intel ME for Raptor Lake
Read about the latest performance boosts, disabling Intel ME, Windows 11 support, and more!
2289
Targeted attack on our management with the Triangulation Trojan
So you’ve heard of blockchain. But how can you use it in your enterprise today? Vitaly Mzokov explores the benefits and security challenges.
2290
Operation Triangulation: iOS devices targeted with previously unknown malware
While monitoring the traffic of our own corporate Wi-Fi network, we noticed suspicious activity that originated from several iOS-based phones. Since it is impossible to inspect modern iOS devices from the inside, we created offline backups of the devices, inspected them and discovered traces of compromise.
2291
2292
More malicious extensions in Chrome Web Store
So far I discovered 18 malicious extensions with 55 million users in total. Most popular ones are: Autoskip for Youtube, Crystal Ad block and Brisk VPN. They have been active for two years, undetected by Google.
2293
Federal judge: Border searches of cell phones require a warrant
With United States v. Smith (S.D.N.Y. May 11, 2023), a district court judge in New York made history by being the first court to rule that a warrant is required for a cell phone search at the border, “absent exigent circumstances” (although other district courts have wanted to do so).EFF is...
2294
Hacking my “smart” toothbrush
After buying a new Philips Sonicare toothbrush I was surprised to see that it reacts to the insertion of a brush head by blinking an LED. A quick online search reveals that the head communicates with the toothbrush handle to remind you when it’s time to buy a new one. From the Philips product page: seems to be REALLY…
2295
Removing support for forwarded ports
Today we announce that we no longer support port forwarding. New port forwards will no longer be supported, and existing ports will be removed 2023-07-01.
2296
Bcrypt at 25
As one of the creators of bcrypt back in 1997, I find it somewhat surprising that, 25 years later, we still rely heavily on passwords. My initial encounter with password security took place in 1993 at the University of Hamburg. Having just discovered Unix, I was fascinated by a service called Yellow Pages that allowed…
2297
Private spies hired by FBI and corporations infiltrate Discord, Reddit, WhatsApp
Leading “threat intelligence” firms are creating fake online personas to gain access to every corner of the web.
2298
Reflections on Ten Years Past the Snowden Revelations
This memo contains the thoughts and recountings of events that transpired during and after the release of information about the NSA by Edward Snowden. There are four perspectives: that of someone who was involved with sifting through the information to responsibly inform the public, a security area director of the…
2299
2300
Phishing domains tanked after Meta sued Freenom
The number of phishing websites tied to domain name registrar Freenom dropped precipitously in the months surrounding a recent lawsuit from social networking giant Meta , which alleged the free domain name provider has a long history of ignoring abuse complaints about phishing websites while monetizing traffic to…
2301
UCLA computer grad constructs “crown jewel of cryptography”
Aayush Jain’s dissertation, “Indistinguishability Obfuscation from Well-Studied Assumptions,” established the feasibility of mathematically rigorous software obfuscation from well-studied hardness conjectures. The central goal of software obfuscation is to transform source code to make it unintelligible without…
2302
PyPI Was Subpoenaed
The PSF received three subpoenas from the US Department of Justice for PyPI user data in March and April of 2023.
2303
SFPD obtained live access to business camera network in anticipation of protest
New documents EFF received through public records requests have revealed that the San Francisco Police Department (SFPD) received live access to the hundreds of surveillance cameras that comprise the Union Square Business Improvement District’s (USBID) camera network in anticipation of potential...
2304
SCOTUS declines to hear challenge to warrantless pole camera surveillance
WASHINGTON — The U.S. Supreme Court today declined to hear Moore v. United States, leaving in place a patchwork of lower court decisions on an...
2305
Google open-sources Rust crate audits
We hope that by sharing our work with the open-source community, we can make the Rust ecosystem even safer and more secure for everyone.
2306
Removing PGP from PyPI
PyPI has removed support for uploading PGP signatures with new releases.
2307
RCE on MikroTik routers with IPv6 RA enabled
MikroTik makes networking hardware and software, which is used in nearly all countries of the world. Our mission is to make existing Internet technologies faster, more powerful and affordable to wider range of users.
2308
€1.2B GDPR fine for Meta
Facebook must stop further transfers of European personal data to the United States, given that Facebook is subject to US surveillance laws (like FISA 702 and EO 12.333).
2309
Malicious VSCode extensions with more than 45k installs
Highlights: CloudGuard Spectral detected malicious extensions on the VSCode marketplace Users installing these extensions were enabling attackers to steal %
2310
The time I accidentally spent a year combatting fraud
Lately, I’ve been spending a lot of time enjoying the Darknet Diaries podcast and it’s compelled me to finally share the story of the most intense year of my