1
Déjà vu: Ghostly CVEs in my terminal title
As I've spoken and written about all modern terminals are actually "emulating" something dating from the 1970s.
New
The latest blog posts to take off on Hacker News. 536 posts.
2
U.S. Army Soldier Arrested in AT&T, Verizon Extortions
Federal authorities have arrested and indicted a 20-year-old U.S. Army soldier on suspicion of being Kiberphant0m , a cybercriminal who has been selling and leaking sensitive customer call records stolen earlier this year from AT&T and Verizon . As first reported by KrebsOnSecurity last month, the accused is a…
3
Colliding with the SHA prefix of Linux's initial Git commit
Or, how to break all the tools that parse the "Fixes:" tag Kees Cook There was a recent discussion about how Linux's "Fixes" tag, which ...
4
Dumping Memory to Bypass BitLocker on Windows 11
Memory-Dump-UEFI is a UEFI application for dumping the contents of RAM.
5
Personal Mail Server on OpenBSD (2019)
I will use this place to relate my geeky adventures in the world of gnu/linux, bsd, the internets, and other important things like windows managers and pretty colors. Basically, it's a place to expose and share with the world things I do on my computer.
6
Finding and exploiting hidden features of Animal Crossing's NES emulator (2018)
While looking for ways to activate the developer menus left over in Animal Crossing, including the NES emulator game selection menu, I found an interesting feature that exists in the original game that was always active, but never used by Nintendo. In addition to the NES/Famicom games that can be obtained in-game, it…
7
Why it's hard to trust software, but you mostly have to anyway
My long-time collaborator Richard Barnes [1] used to say that "in security, trust is a four letter word" , and yet the dominant experience of using any software-based system—which is, you know, pretty much anything electronic—is trusting the manufacturer. Not only is there no meaningful way to determine what software…
8
Apple Photos phones home on iOS 18 and macOS 15
This morning while perusing the settings of a bunch of apps on my iPhone, I discovered a new setting for Photos that was enabled by default: Enhanced Visual Search. (I manually disabled it before taking the screenshot below.)
9
How to Create HTML/ZIP/PNG Polyglot Files
Learn How to Create HTML/ZIP/PNG Polyglot Files!
10
11
Narrative Jailbreaking for Fun and Profit
Posted on Monday 23 Dec 2024. 1,634 words, 1 link. By Matt Webb.
12
Fighting spam with Haskell at Meta (2015)
Visit the post for more.
13
14
Exploiting McDonald's APIs to hijack deliveries and order food for a penny
A series of API flaws in McDelivery India made it possible to order food for a penny, hijack other people’s delivery orders, view user information, and more.
15
Alignment faking in large language models
A paper from Anthropic's Alignment Science team on Alignment Faking in AI large language models
16
How to lose a fortune with one bad click
Adam Griffin is still in disbelief over how quickly he was robbed of nearly $500,000 in cryptocurrencies. A scammer called using a real Google phone number to warn his Gmail account was being hacked, sent email security alerts directly from google.com, and ultimately seized control over the account by convincing him…
17
18
Scanners Beware: Welcome to the network from hell
We’ve crafted a bold defense strategy that not only slows scans but actively disrupts and deceives attackers.
19
20
Clio: A system for privacy-preserving insights into real-world AI use
Anthropic's new system, Clio, analyzes how people use AI while maintaining their privacy.
21
Converting untrusted PDFs into trusted ones: The Qubes Way (2013)
Arguably one of the biggest challenges for desktop security is how to handle those overly complex PDFs, DOCs, and similar files, that are so often exchange...
22
Review of Mullvad VPN
X41 releases the audit report of Mullvad VPN
23
24
25
Compromising OpenWrt Supply Chain
Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc. A few days ago, I was upgrading my home lab network, and I decided to upgrade the OpenWrt on my router.1 After accessing the LuCI, which is the web interface of OpenWrt, I noticed that there is a section called Attended Sysupgrade…
26
0x01 – Killing Windows Kernel Mitigations
This post was made possible through hard work and determination. Do not feel frustrated if this stuff does not click immediately and remember, the source of truth will always be the source code. For us, our source code is raw assembly. That said it’s important you understand these techniques in detail because when…
27
OpenAI o1 system card
This report outlines the safety work carried out prior to releasing OpenAI o1 and o1-mini, including external red teaming and frontier risk evaluations according to our Preparedness Framework.
28
Phishers Love New TLDs Like .shop, .top and .xyz
Phishing attacks increased nearly 40 percent in the year ending August 2024, with much of that growth concentrated at a small number of new generic top-level domains (gTLDs) — such as .shop , .top , .xyz — that attract scammers with rock-bottom prices and no meaningful registration requirements, new research finds…
29
Breaking the 4Chan CAPTCHA
In this blog post, I will talk about my successful experiment in machine learning using TensorFlow to automate solving the 4Chan CAPTCHA.
30
Bootkitty: Analyzing the first UEFI bootkit for Linux
ESET's discovery of the first UEFI bootkit designed for Linux sendss an important message: UEFI bootkits are no longer confined to Windows systems alone.