3511
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,337 posts.
3512
How does a TCP Reset Attack work?
A TCP reset attack is executed using a single packet of data, no more than a few bytes in size. A spoofed TCP segment, crafted and sent by an attacker, tricks two victims into abandoning a TCP connection, interrupting possibly vital communications between them.
3513
Reverse Engineering Apple's typedstream Format
imessage-exporter ’s goal is to provide the most comprehensive representation of iMessage data available. Message data is stored in a legacy format that appears to be a stream that represents objects.
3514
Hacking eInk Price Tags (2021)
Dmitry.GR: Wireless picture frames that run for years on batteries
3515
Simple ways to find exposed sensitive information
Code level discussion of web scraping, gray hat automation, growth hacking and bounty hunting
3516
There’s a rootkit in the closet
Part 1: Finding the rootkit It's monday morning and I am for coffee in downtown Thessaloniki, a partner calls: - On machine XXX mysqld is not starting since Saturday. - Can I drink my coffee and come over later to check it ? Is it critical ? - Nope, come over anytime you can... Around
3517
Is macOS Look Up Destined for CSAM?
Remember Apple’s failed attempt to detect CSAM in images? Would that have been similar to the way that Visual Look Up works? Is this the thin end of the wedge?
3518
Hacking the Samsung NX300 "Smart" Camera
blog about networking, cameras, old gear, and xmpp
3519
We scanned the Internet for port 22
Yesterday (Sept. 12) we scanned the entire Internet for port 22 -- the port reserved for "SSH", the protocol used by sysadmins to remotely l...
3520
Abuse prevention is tradecraft
It’s sunday evening; there’s a lot to be said for being a stay-at-home-dad, and honestly I actually like having stuff like meal-prep and laundry to do, after 35+ years of “All Uni…
3521
Schneier on Security: Recording the Police
I’ve written a lot on the “War on Photography,” where normal people are harassed as potential terrorists for taking pictures of things in public. This article is different; it’s about recording the police: Allison’s predicament is an extreme example of a growing and disturbing trend. As citizens increase their…
3522
Unroll.me
Link to: http://blog.unroll.me/we-can-do-better/
3523
3524
3525
Soatok's Informal Guide to Threat Models
After a long day of exhausting conversations about Hybrid Post-Quantum Cryptography, random jackasses trying to play gotcha with endpoint attacks against end-to-end encrypted messaging apps, and me…
3526
Cypherpunk Desert Bus: My Role in the 2016 Zcash Trusted Setup Ceremony
Update: taking this down for now until some questions about the deterministicbuilds are answered; currently I do not believe the Zcash trusted setup shouldbe...
3527
3528
Fintech Giant Fiserv Used Unclaimed Domain
If you sell Web-based software for a living and ship code that references an unregistered domain name, you are asking for trouble. But when the same mistake is made by a Fortune 500 company, the results can range from costly to disastrous. Here’s the story of one such goof committed by Fiserv [ NASDAQ:FISV ], a $15…
3529
Disassembling the Woolworths Facebook scam
Who wants free stuff? C’mon, everybody wants a free lunch, right? Yes, yes they do and that’s precisely the trigger used in scams like this one. Recently I wrote about the mechanics of another Facebook scam [https://www.troyhunt.com/2012/10/she-did-what-in-school-mechanics-
3530
Open source supply chain security at Google [video]
I was a remote opening keynote speaker at ACM SCORED 2023 , which we decided meant that I sent a video to play and I was on Discord during the talk for attendees to text directly with question as the video played, and then we did some live but still remote Q&A after the talk.
3531
Modeling Adversaries with TLA+
A common question I get about specs is how to model bad actors. Usually this is one of two contexts: The spec involves several interacting agents sharing a protocol, but some of the nodes are faulty or malicious: they will intentionally try to subvert the system. The spec involves an agent subject to outside forces…
3532
I switched to Brave
I've been using Brave for a couple months now after using Firefox for around 25 years. I think Brave will be a permanent change.
3533
3534
3535
The Car That Watches You Back: The Advertising Infrastructure of Modern Cars
How the connected car became an advertising surface. From Stellantis startup pop-ups to GSTV pumps to Gulp Radio aisles, and the consent infrastructure the automobile never developed.
3536
DNS servers that offer privacy and filtering
If you’re a programmer, a systems administrator, or really any type of IT worker, you probably have your favorite go-to IP addresses for troubleshooting.
3537
Docker containers should not run an SSH server
When they start using Docker, people often ask: “How do I get inside my containers?” and other people will tell them “Run an SSH server in your containers!” but that’s a very bad practice. We will see why it’s wrong, and what you should do instead.
3538
MitM Attack against KeePass 2’s Update Check
This post is about a Man in the Middle (MitM) vulnerability in KeePass 2’s automatic update check. KeePass – the free and open source password manager – uses, in all versions up to the current 2.33, unencrypted HTTP requests to check for new software versions. An attacker can abuse this automatic update check – if…
3539
Achieving Great Privacy with Safari
Browsers have always been an arena for fighting and flaming over why your browser is the best and has the most features, while all others are inferior and un...
3540