31
What Happens When You Send a Zero-Day to a Bank?
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/how-to-zero-day-a-bank
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,333 posts.
32
Decoding the obfuscated bash script on a Uniqlo t-shirt
IP, technology & commercial law
33
34
35
Gaining access to anyones Arc browser without them even visiting a website
gaining access to anyones browser without them even visiting a website
36
AI agent bankrupted their operator while trying to scan DN42
An AI agent tried to join the DN42 hobbyist network to perform a network scan, and bankrupted its operator with a $6531.30 AWS bill, to the extent that they are begging for donations from the DN42 community.
37
We Hacked Apple for 3 Months
Between the period of July 6th to October 6th myself, Brett Buerhaus, Ben Sadeghipour, Samuel Erb, and Tanner Barnes worked together and hacked on the Apple bug bounty program.
38
Amazon's customer service backdoor
As a security conscious user who follows the best practices like: using unique passwords, 2FA, only using a secure computer and being able…
39
40
Taking control of all .io domains with a targeted registration
A Hacker's Blog of Unintended Use and Insomnia.
41
It is no longer safe to move our governments and societies to US clouds
The very short version: it is madness to continue transferring the running of European societies and governments to American clouds. Not only is it a terrible idea given the kind of things the “King of America” keeps saying, the legal sophistry used to justify such transfers, like the nonsense letter the Dutch cabinet…
42
43
The Claude Code Source Leak: fake tools, frustration regexes, undercover mode
Anthropic accidentally shipped a source map in their npm package, exposing the full Claude Code source. Here's what I found inside.
44
My daughter's school took over my personal Microsoft account
This weekend I wanted to create a new App in Azure so I could help a local nonprofit automate one of their donor relations processes via email through Office 365. So I tried registering an app by visiting the App Registration Portal. I signed in to my personal Microsoft account, clicked 'New registration', then was…
45
Google's Captcha in Firefox vs. in Chrome
I use Firefox, and this morning I've spent quite some time proving to passive-aggressive Google that I'm not a robot.
46
Apple Photos phones home on iOS 18 and macOS 15
This morning while perusing the settings of a bunch of apps on my iPhone, I discovered a new setting for Photos that was enabled by default: Enhanced Visual Search. (I manually disabled it before taking the screenshot below.)
47
Chrome exempts Google sites from user site data settings
In Google Chrome's "Cookies and site data" settings, accessible via the Preferences menu item or directly with chrome://settings/cookies in the address bar, you can enable the setting "Clear cookies and site data when you quit Chrome". However, I've discovered that Chrome exempts Google's own sites, such as Search and…
48
Intel Publishes Microcode Patches, No Benchmarking or Comparison Allowed
UPDATE: Intel has resolved their microcode licensing issue which I complained about in this blog post. The new license text is here .
49
The Dropbox hack is real
Earlier today, Motherboard reported on what had been rumoured for some time, namely that Dropbox had been hacked [http://motherboard.vice.com/read/hackers-stole-over-60-million-dropbox-accounts] . Not just a little bit hacked and not in that "someone has cobbled together a list of credentials that work
50
51
Why Is This Website Port Scanning Me?
Investigation of the practice of port scanning site visitors for fingerprinting and tracking.
52
Zenbleed
If you remove the first word from the string "hello world" , what should the result be? This is the story of how we discovered that the answer could be your root password!
53
US telcos appear to be selling non-anonymized access to consumer telephone data
https://bit.ly/crazymobiledemo
54
Apple passwords deserve an app
First, let’s consider three random tweets: They already have. They definitely should. They seemingly won’t… but why? We all know that Apple has nice built-in password management in macO…
55
Instagram can track anything you do on any website in their in-app browser
I work with U.S. law firms as a non-testifying technical consulting expert on matters involving the Apple platform and iOS apps. Learn more about my litigation consulting.
56
Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years
Hundreds of millions of Facebook users had their account passwords stored in plain text and searchable by thousands of Facebook employees — in some cases going back to 2012, KrebsOnSecurity has learned. Facebook says an ongoing investigation has so far found no indication that employees have abused access to this data.
57
Stealing Your Private YouTube Videos, One Frame at a Time
David Schütz's bug bounty writeups
58
I Went to SQL Injection Court
Chicago argued that answering a FOIA request with a database query means creating a new record. Matt Chapman sued, I wound up on the stand explaining SQL, and now there's a bill to fix it.
59
Are Xiaomi browsers spyware? Yes, they are (2020)
Xiaomi browsers collect not merely your browsing history but also searches, downloads, YouTube videos watched and much more.
60
LocationSmart Leaked Location Data for All Major U.S. Carriers in Real Time
On May 16th, I found a vulnerability in the LocationSmart website which allowed anyone, with no prior authentication or consent, to obtain the realtime location of any cellphone in the US to within…