3811
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,337 posts.
3812
3813
3814
Distributing unnotarized Mac apps in a text file
This isn't a late April Fools joke. (My April Fools joke that I got hired by Apple as a Swift Evangelist backfired with a profusion of congratulations.) This blog post is a kind of follow-up to some previous blog posts. Last month I wondered what's the best way to distribute Mac apps without notarization , and I…
3815
Liberty Reserve Founder Arrested, Site Shuttered
The founder of Liberty Reserve , a digital currency that has evolved as perhaps the most popular form of payment in the cybercrime underground, was reportedly arrested in Spain this week on suspicion of money laundering. News of the law enforcement action may help explain an ongoing three-day outage at…
3816
Consent, GDPR and Google Analytics
A discussion about the Austrian Google Analytics case, and if consent of the user would have made the difference.
3817
My adventure in designing API keys
Hello everyone, It has been quite a long time since my last blog, the last couple of months had been very busy and packed with a lot of work so I barely had much time to write blogs. Time runs so fast that the last time when I wrote a blog I was still a DevOps Engineer and now I am a Product Developer lol.
3818
Stealing sensitive browser data with the W3C Ambient Light Sensor API (2017)
In this post we describe and demonstrate a neat trick to exfiltrate sensitive information from your browser using a surprising tool: your smartphone or laptop’s ambient light sensor. In short: 1. We provide background about the light sensor API and current discussions to expose it more broadly to websites.
3819
3820
3821
3822
Open source projects could sell SBOM fragments
Musings on SBOMs and licensing woes.
3823
FlightSimLabs Alleged Malware Analysis
UPDATE: Two updates can be found at the bottom of this article revealing the findings from Fidus InfoSec and FSLabs’ response to the…
3824
Where the Apple accounts that hackers are threatening to wipe came from
The tech news recently has seen quite a lot of chatter about an alleged haul of Apple credentials [http://www.zdnet.com/article/apple-icloud-ransom-what-you-need-to-know/], apparently about 250 million of them in all. Allegedly. Maybe. Or was it 300 million? [https://www.macrumors.com/
3825
3826
3827
Leaked Chats Show Lapsus$ Stole T-Mobile Source Code
KrebsOnSecurity recently reviewed a copy of the private chat messages between members of the LAPSUS$ cybercrime group in the week leading up to the arrest of its most active members last month. The logs show LAPSUS$ breached T-Mobile multiple times in March, stealing source code for a range of company projects…
3828
3829
Achilles Heel of OAuth or Why Facebook Adds #_=_
This is a short addition to the previous rants on OAuth problems. We've got Nir Goldshlager working on our side (he simply loves bounties...
3830
3831
What does GitHub's security team even do?
Right now, there are thousands of repositories on GitHub distributing malware. Any of you can find these repositories, and you don’t need any special knowledge to do so. All you have to do is use the standard search function on the GitHub website. These repositories have been around for
3832
3833
Worst-Case Thinking
At a security conference recently, the moderator asked the panel of distinguished cybersecurity leaders what their nightmare scenario was. The answers were the predictable array of large-scale attacks: against our communications infrastructure, against the power grid, against the financial system, in combination with…
3834
3835
Six Harmless Bugs Lead to Remote Code Execution
It was May 2024, and our internal security team was evaluating the LogPoint SIEM/SOAR platform to replace our existing platform, potentially. As part of a habit I’ve built over the years —and honestly, part of our 3rd party due diligence— I gave myself 24 hours to do what I always do with any technology we’re […]
3836
Exploiting McDonald's APIs to hijack deliveries and order food for a penny
A series of API flaws in McDelivery India made it possible to order food for a penny, hijack other people’s delivery orders, view user information, and more.
3837
3838
PlayStation Vita Exploit Reverse Engineering Challenge
We released HENkaku a week ago and were blown away by the reception. There has been over 25k unique installs and every day new homebrew are being announced. This is all thanks to those who contributed to the SDK project back when Rejuvenate was announced. Without a working toolchain for developers and a couple of…
3839
Making art with SSH key randomart
SSH is everywhere in the development or operations world now. For development it’s what allows you to push to GitHub. For operations it’s what allows you to reasonably securely log into Linux servers.
3840
Chat Control 2.0 through the back door
Just before a decisive meeting in Brussels, digital rights expert and former Member of the European Parliament Dr. Patrick Breyer is sounding the alarm. Using a "deceptive sleight of hand," a mandatory and expanded Chat Control is being pushed through the back door, in a form even more intrusive tha