Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,333 posts.
The Visual Studio Code server in Windows Subsystem for Linux uses a local WebSocket WebSocket connection to communicate with the Remote WSL extension. JavaScript in websites can connect to this server and execute arbitrary commands on the target system. Assigned CVE-2021-43907 and zero bounty. I paid 5 USD for the EC2…
This year (2016) I accepted as much incident response work as I could. I spent about 300 hours responding to security incidents and data…
I’m a frequent critic of memory unsafe languages, principally C and C++, and how they induce an exceptional number of security vulnerabilities. My conclusion, based on reviewing evidence from numerous large software projects using C and C++, is that we need to be migrating our industry to memory safe by default…
Statistics Norway wants to receive several million daily receipts from food stores, signalling a new era in state data collection. Privacy advocates and the supermarkets themselves are unhappy. People living in Norway are used to
In an open letter, seven secure messaging apps—including Signal and WhatsApp—point out that the UK’s Online Safety Bill could destroy end-to-end encryption: As currently drafted, the Bill could break end-to-end encryption,opening the door to routine, general and indiscriminate surveillance of personal messages of…
( These are my notes from the first half of my talk at HOPE9 last weekend. I write notes like these not as a script, but so that I have at least some words ready in my head when I'm speaking. They are more conversational and less organised than a usual blog post, so please forgive me the rough edges. )
Last week I wanted to replace my OpenVPN setup with WireGuard. The basics were well-documented, going beyond the basics was a bit trickier. Let me teach you want I learned. The basics But first, let’s summarize the basics. I have a server with a hosting provider that I want to use as a VPN server. I won’t delve into…
The new $30 AirTag tracking device from Apple has a feature that allows anyone who finds one of these tiny location beacons to scan it with a mobile phone and discover its owner’s phone number if the AirTag has been set to lost mode. But according to new research, this same feature can be abused to redirect the Good…
Personal Blog of Christian Haschek
I'm organizing a boycott of Apple's Feedback Assistant , starting immediately, and I encourage all Apple developers to join me. Here's how I propose that each of us can effectively participate in the boycott and let Apple know that we're boycotting Feedback Assistant:
In hope that public disclosure will encourage Google to fix this, despite refusing to, here goes...
Many people will land on this page after learning that their email address has appeared in a data breach I've called "Collection #1". Most of them won't have a tech background or be familiar with the concept of credential stuffing so I'm going to write this post
pipdig, WordPress theme and plugin provider, caught distributing malicious code to customers and DDoSing competitors…
A security research blog.
An elusive hacker who went by the handle “ UNKN ” and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face. Authorities in Germany say 31-year-old Russian Daniil Maksimovich Shchukin headed both cybercrime gangs and helped carry out at least 130 acts of computer sabotage and extortion…
Some of the most successful and lucrative online scams employ a “low-and-slow” approach — avoiding detection or interference from researchers and law enforcement agencies by stealing small bits of cash from many people over an extended period. Here’s the story of a cybercrime group that compromises up to 100,000 email…
How one unchecked login token put 17 trillion rows in a Microsoft internal analytics service within reach.
TL;DR: If you have a LinkedIn account, you were signed up to SlideShare automatically without your knowledge or consent. Your account including all your personal information will be sold to ScribD …
We discovered that entire sections describing domestic U.S. intelligence facilities were deliberately removed from two published documents, while equivalent foreign facilities remained visible. The evidence exists in an unexpected place - the PDF metadata of documents published by The Intercept in 2016, and by The…
Today I am going to publicly disclose a critical vulnerability I have found during my research in PayPal, This vulnerability enabled me to completely bypass the CSRF Prevention System implemented by PayPal, The vulnerability is patched very fast and PayPal paid me the maximum bounty they give ;).
In May last year, a new attack on the Diffie Hellman algorithm was released, called Logjam . At the time, I was working on a security team, so it was our responsiblity to check that none of our servers would be affected. We ran through our TLS config and decided it was safe, but also needed to check that our SSH…
Update: this post generated some interesting discussion on Hacker News. Friendly fraud is the laundered name for something that the payment system is not really able to prevent. Even though I’m pretty sure they can do way better. Particularly big and sophisticated payment providers like Stripe, with a mountain of…
On Friday January 21, 2022 I received this email. I tweeted about it and it took off like crazy. The email comes from a fortune-500 multi-billion dollar company that apparently might be using a product that contains my code, or maybe they have customers who do. Who knows? My guess is that they do this … Continue…
I've got 2 massive things to announce today that have been a long time in the works and by pure coincidence, have aligned such that I can share them together here today. One you would have been waiting for and one totally out of left field. Both these announcements
