Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,335 posts.
An algorithmic complexity attack is a denial of service attack that triggers worst case behaviour in code that is otherwise expected to perform well. The canonical example would be the widely published attacks against hash table implementations , where carefully crafted inputs made snappy \(O(1)\) operations…
Silently sends up to 255 bytes of the client's heap to the server . The server must support NPN , and the heap data is encrypted in transit.
Dmitry.GR: Creating BTLE-compliant advertisement packets, so that iOS and android devices can see and parse them.
Today’s Washington Post has a story entitled “Johns Hopkins researchers poke a hole in Apple’s encryption”, which describes the results of some research my students and I have bee…
“I Know This” is a game I made for the Global Game Jam 2015 along with Gavin McCarthy (art, design), Adam Axbey (sound effects) and Matthew Simmonds (4mat) (music); I did programming and design. The name we chose for the team was Two’s Complement .
The goal of this blog is to share write-ups about bugs i have found in Facebook and reported to them under the Facebook bug bounty program.
Dmitry.GR: Complete device takeover by blinking at it!
There certainly is one thing that most Linux users don't realize about their Linux systems... this is the lack of GUI-level isolation, and ...
The European Union AI Act will begin to be enforceable in August 2026, one month from now. One of the biggest new requirements is Article 50, which requires all…
OpenSSL sucks. The BoringSSL and AWS-LC forks are Googled and Amazoned to death; they don't care about anyone but their own use cases. I can't remember ever having a good experience with software using GnuTLS. LibreSSL is incomplete... FOREWARD This post is about the experience of taking a leap of …
Posts and writings by Lennart Poettering
The newest Windows 10 update includes OpenSSH utilities, including ssh-agent. Here’s how to extract unencrypted saved private keys from the registry
From time to time, there emerge cybersecurity stories of such potential impact that they have the effect of making all other security concerns seem minuscule and trifling by comparison. Yesterday was one of those times. Bloomberg Businessweek on Thursday published a bombshell investigation alleging that Chinese cyber…
Introduction In a previous post , I introduced a Twitter bot called dumpmon which monitors paste sites for account dumps, configuration fi...
This article documents Hacking Team’s third-party acquisition of zero-day (0day) vulnerabilities and exploits. The recent compromise of Hacking Team’s email archive offers one of the first public case studies of the market for 0days. Because of its secretive nature, this market has been the source of endless debates…
Correction: An earlier draft of this story misstated a technical detail; Mark didn’t email his photo to his doctor; rather, he took the photo with his phone and the image was automatically synched to his Google Photos account, triggering a scan .
Actually this is a common method of combatting spam, all of the various spam providers will block facebook as a whole if they don't include this information, which would obviously be a devastating annoyance. Go and send an e-mail from hotmail, or any kind of mailserver.. normal e-mail client, gmail, etc.. and you will…
A very sus sysctl in the XNU kernel.
I’ve been considering purchasing one of these t-shirts: This shirt would announce to everyone who crosses my path that I am, in fact, the world’s greatest lover. They would know this because I have a t-shirt that tells them so and it would give them enormous
"Minerva attack can recover private keys from smart cards, cryptographic libraries" , says the ZDNet headline. "The Czech team found a problem in the ECDSA and EdDSA algorithms used by the Atmel Toolbox crypto library to sign cryptographic operations on Athena IDProtect cards."
I’m doing a deep dive into the pre-history of the Fourth Amendment, and am continuously amazed at how perfectly the condemnations of the “general warrants” that incensed the Framers apply to the programmatic authority granted the NSA under the FISA Amendments Act. The legal challenge to that statute is currently hung…
Reverse engineering an unfamiliar data file could be described as the bootstrapping of understanding. In many ways the process resembles the scientific method, only applied to human-made, abstract objects instead of the natural world. You begin by gathering data, and then you use that information to put forth one or…
In this write-up we're going to take a look at exploiting the Wii U's USB Host Stack. Over the past few months I spent a lot of time reverse...
Secret NSA documents showed that NSA pushed DES in the 1970s to "drive out competitors" while knowing that DES was "weak enough" to break; meanwhile NSA publicly claimed that it would use DES . NSA used export-law exceptions in the 1990s to entrench RC4 and RSA-512, causing security problems for decades . NSA in the…
