1411
Remote Code Execution in Alpine Linux
tl;dr I found several bugs in apk, the default package manager for Alpine Linux. Alpine is a really lightweight distro that is very commonly used with Docker...
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,333 posts.
1412
The EC2 firewall is broken
As most standards-aware network administrators know, blocking ICMP is evil. Sure, there are certain ICMP packets which should be blocked; but to quote RFC 2979 :
1413
Analyzing Analytics (Featuring: The FBI)
Recently while conducting some research, I found myself down the path of Google Analytics ID's as well as other analytics services. I was investigating ways to not only identify varying analytics code in sites, but to correlate them with ot…
1414
NSA in P/poly: The Power of Precomputation
Even after the Snowden revelations, there remained at least one big mystery about what the NSA was doing and how. The NSA’s classified 2013 budget request mentioned, as a priority item, R…
1415
Linux Reverse Engineering CTFs for Beginners
After a while, I decided a write a short blog post about Linux binary reversing CTFs in general. How to approach a binary and solving for beginners. I personally am not a fan of Linux reverse engin…
1416
Fake chips, I got stung
Unfortunately, in the tech sector, just like many other sectors, there are scammers around. When you are dealing with electronics this is typically in the form of chips that have had their markings…
1417
The presumption that computers are working correctly
The first in a series of posts on the Post Office Horizon prosecutions scandal
1418
Choosing a Public DNS Resolver
Compare 30 global public DNS resolvers by privacy, filtering, DNSSEC, DoH, DoT, DoQ, IPv6, and jurisdiction, and benchmark DoH speed from your browser.
1419
1420
LG TV logging filenames from network folders
After DoctorBeet’s blog post detailing his LG TV’s shady logging practices I decided to have a look at what my own was doing. To start off I couldn’t seem to find an option to disable logging…
1421
1422
FBI Harassment
Obligatory Disclaimer: Personal or political views presented within this post absolutely do not reflect those of my employer(s), client(s), and/or legal counsel.
1423
1424
SSH: Best practices
The comments around the last OpenSSH issue ( CVE 2016-0777 , you must read excellent Qualys’ analysis if you’re interested with the details), I noticed that many people were not aware of some basic features of OpenSSH. I will attempt to give a few advises, prioritized in feasibility order, and with graphical…
1425
Canadian man stuck in triangle of e-commerce fraud
A Canadian man who says he’s been falsely charged with orchestrating a complex e-commerce scam is seeking to clear his name. His case appears to involve “triangulation fraud,” which occurs when a consumer purchases something online — from a seller on Amazon or eBay , for example — but the seller doesn’t actually own…
1426
Password Requirements: Myths and Madness
Password requirements are weird. It seems impossible to set a new password in many websites. Why?
1427
Hyundai Head Unit Hacking
Standard-class Gen5 navigation
1428
1429
Evidence that the NSA Is Storing Voice Content, Not Just Metadata
Interesting speculation that the NSA is storing everyone’s phone calls, and not just metadata. Definitely worth reading. I expressed skepticism about this just a month ago. My assumption had always been that everyone’s compressed voice calls is just too much data to move around and store. Now, I don’t know. There’s a…
1430
USB Reverse Engineering: Down the Rabbit Hole
Thanks for the featured writeup Hackaday! Make sure to check out the comments over there as well. Looks like Hackernoon picked it up as well, make sure to check in with the comments there too. It would be great if you could also head over to Hacker News, give an upvote, and join in the comments there. Let's get this…
1431
Curl Security Audit
"the overall impression of the state of security and robustness of the cURL library was positive." I asked for, and we were granted a security audit of curl from the Mozilla Secure Open Source program a while ago. This was done by Mozilla getting a 3rd party company involved to do the job and footing … Continue…
1432
Site requests bank logins for online purchases
I’ve spent a lot of time trying to educate people on being careful with credentials. It really doesn’t help when I try to place a purchase with a “legitimate” supplier, and, after handing over valid credit card details, I get this:
1433
How I Could Have Hacked Any Instagram Account
This article is about how I found a vulnerability on Instagram that allowed me to hack any Instagram account without consent permission. Facebook and Instagram security team fixed the issue and rewarded me $30000 as a part of their bounty program. Facebook is working constantly to improve its security controls on all…
1434
Breaking homegrown crypto
Anubis could not load its JavaScript. The server may be overloaded. Please reload the page to try again.
1435
Apple Is Listening
They had encountered significant turbulence in the product line over the preceding years, especially Macs. It was a rough time to be a pro Mac user.
1436
Iran-backed hackers claim wiper attack on medtech firm Stryker
A hacktivist group with links to Iran’s intelligence agencies is claiming responsibility for a data-wiping attack against Stryker , a global medical technology company based in Michigan. News reports out of Ireland, Stryker’s largest hub outside of the United States, said the company sent home more than 5,000 workers…
1437
Bloomberg’s ‘The Big Hack’
One way or the other, there is more to come on this story, and either Bloomberg’s or Apple’s and Amazon’s credibility is going to take a significant hit.
1438
A Bug in Early Creative Commons Licenses Has Enabled Copyleft Trolls (2022)
Copyleft trolls, robosigning, and Pixsy.
1439
GitHub has not removed malicious imitation software after 3 weeks
On the 31st August I got an email from a customer, telling me that they had found an imitation of my data wrangling software on Github. I’m not linking to it, but here is a screenshot: It is …
1440
On Cybersecurity and Being Targeted
Last month, I was the subject of a targeted cyber attack. Someone went through substantial lengths to attempt to gain access to my GitHub account, but were...