2431
New
The latest blog posts to take off on Hacker News. 8,770 posts.
2432
Hacking the Nintendo DSi Browser
I managed to exploit the Nintendo DSi browser 15 years after it was released in Japan. This post will go over the journey and the technical details.
2433
Live2D Is a Security Trainwreck
derailed by dangling pointers
2434
Mullvad becomes highest level of Tor Member (Shallot)
Mullvad has been a Tor Project Vidalia Onion Member since 2021 and has now become a Shallot Onion Member of Tor.
2435
Belgium launches nationwide safe harbor for ethical hackers
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
2436
Germany opposes EU plans for client-side scanning
Germany opposes client-side scanning planned by EU - it would create an unprecedented surveillance monster that violates fundamental rights.
2437
First in-the-wild UEFI bootkit bypassing UEFI Secure Boot
ESET researchers are the first to publish an analysis of BlackLotus, the first in-the-wild UEFI bootkit capable of bypassing UEFI Secure Boot.
2438
I quit infosec and I couldn't be happier
This article aims at providing you some insights about the experience I had in the “infosec world” for the past few years. I had an amazing journey and grateful for everything that happened. Don’t get me wrong with the title, even if the road was sometimes “bumpy” (aka ‘bad’ experiences), I got some good lessons…
2439
How SMS fraud works and how to guard against it
or why Twitter disabled SMS 2FA 💬
2440
Hackers claim they breached T-Mobile more than 100 times in 2022
Three different cybercriminal groups claimed access to internal networks at communications giant T-Mobile in more than 100 separate incidents throughout 2022, new data suggests. In each case, the goal of the attackers was the same: Phish T-Mobile employees for access to internal company tools, and then convert that…
2441
2442
We will not ‘walk out’ of UK, nor comply with any request to bypass encryption
Tutanota: We will not 'walk out' of UK like Signal. Nor will we comply with any request to bypass our encryption.
2443
2444
Lessons from the Debian/OpenSSL Fiasco (2008)
Last week, Debian announced that in September 2006 they accidentally broke the OpenSSL pseudo-random number generator while trying to silence a Valgrind warning. One effect this had is that the ssh-keygen program installed on recent Debian systems (and Debian-derived systems like Ubuntu) could only generate 32,767…
2445
My daughter's school took over my personal Microsoft account
This weekend I wanted to create a new App in Azure so I could help a local nonprofit automate one of their donor relations processes via email through Office 365. So I tried registering an app by visiting the App Registration Portal. I signed in to my personal Microsoft account, clicked 'New registration', then was…
2446
2447
How to weaponize the Yubikey (2019)
Michael Allen // A couple of years ago, I had a YubiKey that was affected by a security vulnerability, and to fix the issue, Yubico sent me a brand new […]
2448
A tale of Phobos – How we almost cracked a ransomware using CUDA
For the past two years we've been tinkering with a proof-of-concept decryptor for the Phobos family ransomware. It works, but is impractical to use for reasons we'll explain here. Consequently, we've been unable to use it to help a real-world victim so far. We've decided to publish our findings and tools, in hope that…
2449
2450
How to date a recording using background electrical noise
Three men were accused of selling firearms to South London gangs. At their 2012 trial in Croydon Crown Court, the prosecution played the jury a recording, taken undercover, of the trio allegedly arranging a sale. But the men’s lawyers claimed that the recording was a fake, and that the police had fabricated it by…
2451
FCC Considering Banning Transfer of Online Consent Forms
Editor’s note: this version was updated at 6:00 pm pacific to include a couple of paragraphs that were omitted from the original post. Also–HI to all the thousands of regular people coming to visit today. I get it–we ALL hate unwanted calls and texts. But destroying the infrastructure of connecting consumers with…
2452
2453
Security audit of account and payment services
Assured AB were contracted to perform a security assessment of our account and payment services between 2022-11-07 and 2022-11-29.
2454
Valve bans 40k Dota 2 accounts using honeypot patch
Today, we permanently banned over 40,000 accounts that were using third-party software to cheat in Dota over the last few weeks. This software was able to access information used internally by the Dota client that wasn't visible during normal gameplay, giving the cheater an unfair advantage. While fixing the…
2455
Let's build a Chrome extension that steals as much data as possible
Today's adventure: DIY whole hog data exfiltration
2456
What is the randomart image for?
When you generate an SSH key (like I did when looking at signing commits with SSH keys ), you get a “randomart image” from ssh-keygen . These things:
2457
Down the Cloudflare / Stripe / OWASP Rabbit Hole
I found myself going down a previously unexplored rabbit hole recently, or more specifically, what I thought was "a" rabbit hole but in actual fact was an ever-expanding series of them that led me to what I refer to in the title of this post as "6 rabbits deep"
2458
2459
Mozilla solves the Manifest V3 puzzle to save ad blockers
Google Chrome's new platform for extensions, Manifest V3, threatens to limit the functionality of ad blockers. Firefox has found a way around this problem. Read how.
2460
Unpacking the Benefits of Zero Trust Architecture as Defined by NIST
NIST has released a draft of SP 1800-35 , Implementing a Zero Trust Architecture. The lengthy documents lay out their definition of Zero Trust Architecture (ZTA) , the benefits, why it’s important, a few examples of how an organization can implement them, expected results associated with their example builds, and a…