241
New
The latest blog posts to take off on Hacker News. 579 posts.
242
243
SWATters Target Dozens of Journalists
Nearly three dozen journalists at a broad range of major publications have been targeted by a far-right group that maintains a Deep Web database listing the personal information of people who threaten their views. This group specializes in encouraging others to harass those targeted by their ire, and has claimed…
244
245
246
247
An Analysis of WeChat’s Realtime Image Filtering in Chats
In this work, we study how Tencent implements image filtering on WeChat. We found that Tencent implements realtime, automatic censorship of chat images on WeChat based on what text is in an image and based on an image’s visual similarity to those on a blacklist. Tencent facilitates this realtime filtering by…
248
Why Rust for safe systems programming
In this series , we have explored the need for proactive measures to eliminate a class of vulnerabilities and walked through some examples of memory safety issues we’ve found in Microsoft code that could have been avoided with a different language. Now we’ll peek at why we think that Rust represents the best…
249
Understanding Docker Container Escapes
Trail of Bits recently completed a security assessment of Kubernetes, including its interaction with Docker. Felix Wilhelm’s recent tweet of a Proof of Concept (PoC) “container escape” sparked our interest, since we performed similar research and were curious how this PoC could impact Kubernetes. Quick and dirty way…
250
251
Trust is good, control is better: Reproducible builds at F-Droid
Free Software is a great thing, because it allows users to check that apps are doing what they pretend to do. But almost nobody compiles apps themselves.
252
253
QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware Attack
Cloud hosting provider iNSYNQ says it is trying to recover from a ransomware attack that shut down its network and has left customers unable to access their accounting data for the past three days. Unfortunately for iNSYNQ, the company appears to be turning a deaf ear to the increasingly anxious cries from its users…
254
255
256
Authentication and the Have I Been Pwned API
The very first feature I added to Have I Been Pwned after I launched it back in December 2013 was the public API [https://www.troyhunt.com/have-i-been-pwned-you-can-now-ask-api/]. My thinking at the time was that it would make the data more easily
257
XSS attacks on Googlebot allow search index manipulation
Googlebot is based on Google Chrome version 41 (2015), and therefore it has no XSS Auditor, which later versions of Chrome use to protect the user from XSS attacks…
258
259
Google Chrome is ditching its XSS detection tool
The Sophos Blog
260
261
How I Could Have Hacked Any Instagram Account
This article is about how I found a vulnerability on Instagram that allowed me to hack any Instagram account without consent permission. Facebook and Instagram security team fixed the issue and rewarded me $30000 as a part of their bounty program. Facebook is working constantly to improve its security controls on all…
262
HTTP Security Headers – A Complete Guide
A description of each security header, why it is important, and how to configure your website in a secure way.
263
Github became the web's largest font piracy site (2017)
Front-end antics and typographic mischievousness
264
A proactive approach to more secure code
Microsoft Security Response Center Blog2019132 points28 commentscited by 17Security & Privacy details
What if we could eliminate an entire class of vulnerabilities before they ever happened?
265
How to Find Hidden Cameras in Your Airbnb
How to Find Hidden Cameras in your AirBNB, Author: Johannes Ullrich
266
267
Cracking My Windshield and Earning $10k on the Tesla Bug Bounty Program
One of the more interesting things I've had the opportunity to hack on is the Tesla Model 3. It has a built in web browser, free premium LTE, and over-the-air software updates. It's a network connected computer on wheels that drives really fast.
268
269
A problem worse than Zoom?
On macOS, an app can register to handle URL schemes. Web browsers such as Safari, Chrome, and Firefox register to handle the schemes for web pages, http or https . Non-browser apps may register to handle other URL schemes; for example, an email client may register to handle the well known mailto scheme. When a URL is…
270
QCSuper: A tool for capturing 2G/3G/4G air traffic on Qualcomm-based phones
QCSuper, an open-source tool, helps capture mobile network frames from Qualcomm-based Android devices, enabling analysis in Wireshark and more.