241
Rooting, firmware analysis and persistent credentials of TP-Link TL-841N
round 2: rooting & analysing firmware of the TP-Link TL-WR841N
New
The latest blog posts to take off on Hacker News. 718 posts.
242
A Surveillance Treaty in Disguise: Canada Signs UN Cybercrime Convention
Last week, the government announced that Canada has signed the United Nations Convention against Cybercrime, with Ministers Anita Anand, Gary Anandasangaree and Sean Fraser touting the treaty’s child protection provisions and human rights safeguards, which were described as “among the strongest found in an…
243
Tailscale didn't stop the Hugging Face intrusion
An AI agent used a stolen Tailscale auth key at Hugging Face. Workload identity federation, flow logs, and safer defaults could have reduced the risk.
244
Authorize, don't authenticate
Hold on to your data by keeping it in your own database
245
Google fixed more Chrome bugs in June than over the past two years, thanks to AI
Chrome uses Gemini AI to automate vulnerability discovery, triage, and patching, accelerating updates to match modern security risks.
246
Investigating three real-world incidents in our cybersecurity evaluations
We found three cases where a Claude model reached the internet from an evaluation environment and accessed real systems. We share what happened and what we're changing.
247
Read this before you buy that TV streaming stick
Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user’s Internet connection out to strangers. But a groundbreaking new analysis finds these devices also routinely spoof…
248
249
1,741 "informed" consents with one click? GDPR complaint filed
dict.cc requests users to consent to the tracking by 1,741 "partner" companies. This makes it impossible for people to know what happens to their data
250
Some thoughts about Anthropic's new cryptanalysis results
Yesterday Anthropic published two new cryptanalysis results, both outputs of Claude Mythos, their (still) unreleased advanced model. The first of these results attacks a signature scheme called HAW…
251
San Francisco: Don't Fall for Industry Defense of Surveillance Pricing
The concept of “surveillance pricing” is just one part of a much larger problem and business model: corporations maximizing their profits by invading our privacy. The all-too-common business model is to systematically harvest, collate, and store as much of our personal data as possible, and then...
252
Document-borne AI worms can self-propagate through Copilot for Word
I would like to thank Microsoft product teams and Microsoft Security Response Center (MSRC) for collaborating with me on this technical analysis and mitigation of the disclosed vulnerabilities. The editorial opinions reflected below are solely the author’s and do not necessarily reflect those of the organizations I…
253
Discovering Cryptographic Weaknesses with Claude
Anthropic researchers find weaknesses in cryptographic algorithms with Claude Mythos Preview
254
Italy Blocks Reproductive Health Websites Women on Web and Women Help Women
This report documents the blocking of Women on Web (WoW) and Women Help Women (WHW) domains in Italy based on OONI data.
255
DMARC has been public since 2012 but most company domains still don't enforce it
DMARC has been public since 2012. We checked 67,336 domains: 68.4% still have no policy or one that does not enforce it.
256
Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles
VE Commercial Vehicles’ My Eicher platform had a critical vulnerability that let you take over anyone’s account and gain control over their vehicle fleets.
257
What does GitHub's security team even do?
Right now, there are thousands of repositories on GitHub distributing malware. Any of you can find these repositories, and you don’t need any special knowledge to do so. All you have to do is use the standard search function on the GitHub website. These repositories have been around for
258
259
The relay market powering token resellers and fraud
A look inside the gray-market reseller economy that gives mainland China cheap, structured, B2B-grade access to OpenAI, Anthropic, Google, and beyond
260
261
Memory safety absolutists
When seeing the title of this post, I bet in some people's minds, the first thought was "Rust devs!". This connection is not unfounded. Rust devs tend to be passionate about memory safety. Some of it, I'm sure, may have been caused by a classic language wars attitude: my language is better than yours, and here is why…
262
Android may soon restrict on-device ADB
Changes proposed for ADB could kill an entire ecosystem of open-source power-user apps, mobile developer setups, and rootless privacy tools based on Shizuku.
263
My security camera shipped a GitHub admin token in its login page
i dissected some firmware for a Hanwha Wisenet XNP-9300RW and found that it had github admin tokens in it, also miltech is weird
264
Introducing selfie for sign-in: a new way to access your Google Account
Selfie video gives you more options if you’re ever locked out or don’t have access to your usual phone or computer.
265
Securing Services with Rootless Containers
Some tips to improve security in applications deployed as containers.
266
OpenAI’s accidental attack against Hugging Face is science fiction that happened
This story is wild. The short version: OpenAI were running a cybersecurity test against an unreleased model, with the model’s guardrail features turned off. Rather than solve the test, the …
267
I Inspected My Take-Home Interview Project. It Was a Whole Operation
Appaji, a Computer Science graduate from IIT Patna and former intern at Arista Networks, is a Software Engineer at Infinite Reality. Passionate about building innovative web experiences, with a strong interest in sustainable and customer-focused startups.
268
LG to ban residential proxies from smart TV apps
The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one’s television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG’s…
269
OpenAI and Hugging Face address security incident during model evaluation
OpenAI and Hugging Face share early findings from a security incident during AI model evaluation, highlighting advanced cyber capabilities and lessons for defenders.
270
Firefox Containers Preview
Today, we’re excited to announce the Preview of Containers in Firefox version 153, which lets you keep separate parts of your online life (work, shopping