211
New
The latest blog posts to take off on Hacker News. 556 posts.
212
Into the Borg – SSRF inside Google production network
Intro - Testing Google Sites and Google Caja In March 2018, I reported an XSS in Google Caja, a tool to securely embed arbitrary html/javascript in a webpage. In May 2018, after the XSS was fixed, I r
213
214
Credit card thieves using free-to-play apps to launder their ill-gotten gains
This MacKeeper report will tell you about 6 major data breaches that happened in 2018.
215
Riot Games Approach to Anti-Cheat
Combating cheats is an ever-evolving arms race. The scope and complexity of cheat development grows every year along with the stakes in online gaming. The pressure is on for game studios to level up when it comes to detecting and preventin…
216
Mailinator.com: Anatomy of a Spammy Campaign
Mailinator is a popular disposable email service. It's also become a great tool for QA Teams to test email receipt, acknowledgment, authen...
217
Mitigating Spectre with Site Isolation in Chrome
Posted by Charlie Reis, Site Isolator Speculative execution side-channel attacks like Spectre are a newly discovered security risk for web...
218
Finding and exploiting hidden features of Animal Crossing's NES emulator
While looking for ways to activate the developer menus left over in Animal Crossing, including the NES emulator game selection menu, I found an interesting feature that exists in the original game that was always active, but never used by Nintendo. In addition to the NES/Famicom games that can be obtained in-game, it…
219
220
Implementing Open Source Container Security, Part 1: Runtime Security
Expert insight, best practices, and advice on Secure DevOps, security for containers, Kubernetes, and cloud services. Review Sysdig blog posts today!
221
How to build an NPM worm
npm is a registry and package manager for JavaScript that ships as part of Node.js . It's used by tens of millions of people to install hundreds of thousands of packages billions of times every week.
222
Postmortem for Malicious Packages Published on July 12th, 2018
A pluggable and configurable linter tool for identifying and reporting on patterns in JavaScript. Maintain your code quality with ease.
223
Notorious ‘Hijack Factory’ Shunned from Web
Score one for the good guys: Bitcanal , a Portuguese Web hosting firm long accused of helping spammers hijack large swaths of dormant Internet address space over the years, was summarily kicked off the Internet this week after a half-dozen of the company’s bandwidth providers chose to sever ties with the company.
224
225
Shutting Down the BGP Hijack Factory
Oracle Blog
226
227
228
OAuth for the Open Web
OAuth has become the de facto standard for authorization and authentication on the web. Nearly every company with an API used by third party developers has implemented OAuth to enable people to build apps on top of it.
229
Yes, Amazon Is Tracking People
In order to protect civil liberties without hampering innovation, lawmakers should require public input before surveillance tools are deployed and ensure that facial recognition databases are purged of data related to law-abiding people.
230
EnclaveDB: A secure database using SGX
EnclaveDB: A secure database using SGX Priebe et al., IEEE Security & Privacy 2018 This is a really interesting paper (if you’re into this kind of thing I guess!) bringing together the security…
231
Police search homes of Zwiebelfreunde board members and OpenLab in Augsburg
On June 20th, board members of the „Zwiebelfreunde“ association in multiple German cities had their homes searched under the dubious pretence that they were „witnesses“ while their computers and...
232
Google to developers: We take down your extension because we can
Today, I found this email from Google in my inbox: We routinely review items in the Chrome Web Store for compliance with our Program policies to ensure a safe and trusted experience for our users. We recently found that your item, “Google search link fix,” with ID: cekfddagaicikmgoheekchngpadahmlf, did not comply with…
233
“Stylish” browser extension steals all your internet history
Before it became a covert surveillance tool disguised as an outstanding browser extension, Stylish really was an outstanding browser extension. It bestowed upon its users nothing less than the power to change the appearance of the internet. Its extensive bank of user-made skins gave bright websites a dark background…
234
Digicert Withdraws from the CA Security Council
DigiCert is electing to withdraw from the CA Security Council (CASC) as we believe CASC is moving in a direction that DigiCert does not support. Read more.
235
EFF Sues to Invalidate FOSTA, an Unconstitutional Internet Censorship Law
We are asking a court to declare the Allow States and Victims to Fight Online Sex Trafficking Act of 2017 (“FOSTA”) unconstitutional and prevent it from being enforced. The law was written so poorly that it actually criminalizes a substantial amount of protected speech and, according to experts,...
236
Against privacy defeatism: why browsers can still stop fingerprinting
In this post I’ll discuss how a landmark piece of privacy research was widely misinterpreted, how this misinterpretation deterred the development of privacy technologies rather than spurring it, how a recent paper set the record straight, and what we can learn from all this. The research in question is about browser…
237
AntiPolygraph.org appears to have been “de-listed” from Google on key searches
Search DuckDuckGo for “polygraph” and you’ll find AntiPolygraph.org, which hosts more documentation on polygraphs than any other site on the Internet, in the top 10 results. The same is true for searches on “polygraph” with Microsoft’s Bing search engine (in the United States), with Russia’s Yandex search engine, and…
238
Exposing the secret Office 365 detailed activity logs and forensics tool
An ethical crisis in the digital forensics industry came to a head last week with the release of new details on Microsoft’s undocumented “Activities” API. A previously unknown trove of access and activity logs held by Microsoft allows investigators to track Office 365 mailbox activity in minute detail. Following a…
239
Wi-Fi Alliance Introduces Wi-Fi Certified WPA3 Security
Next generation Wi-Fi® security for personal and enterprise networks
240
Testing Firefox Monitor, a New Security Tool
From shopping to social media, the average online user will have hundreds of accounts requiring passwords. At the same time, the number of user data breaches occurring each year continues ...