2131
Kerberoasting
I learn about cryptographic vulnerabilities all the time, and they generally fill me with some combination of jealousy (“oh, why didn’t I think of that”) or else they impress me w…
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,335 posts.
2132
Researchers quietly cracked Zeppelin ransomware keys
Peter is an IT manager for a technology manufacturer that got hit with a Russian ransomware strain called “ Zeppelin ” in May 2020. He’d been on the job less than six months, and because of the way his predecessor architected things, the company’s data backups also were encrypted by Zeppelin. After two weeks of…
2133
Many public Salesforce sites are leaking private data
A shocking number of organizations — including banks and healthcare providers — are leaking private and sensitive information from their public Salesforce Community websites, KrebsOnSecurity has learned. The data exposures all stem from a misconfiguration in Salesforce Community that allows an unauthenticated user to…
2134
New 0-Day Attacks Linked to China's 'Volt Typhoon'
Malicious hackers are exploiting a zero-day vulnerability in Versa Director , a software product used by many Internet and IT service providers. Researchers believe the activity is linked to Volt Typhoon , a Chinese cyber espionage group focused on infiltrating critical U.S. networks and laying the groundwork for the…
2135
A Beginner's Guide to Firewalling with pf
This guide is written for the person very new to firewalling. Please realize that the sample firewall we build should not be considered appropriate for actual use. I just try to cover a few basics, that took me awhile to grasp from the better known (and more detailed) documentation referenced below
2136
Hostnames and usernames to reserve
If you're setting up a service where people can register their own usernames to be used as a hostname (username.example.com), email address (username@example.com), or URL path (example.com/username) within your domain, there are some common names you should avoid letting the general public register. Many …
2137
Is it possible to allow sideloading and keep users safe?
In which I attempt to be pragmatic. Are you allowed to run whatever computer program you want on the hardware you own? This is a question where freedom, practicality, and reality all collide into a mess. Google has recently announced that Android users will only be able to install apps which have been digitally signed…
2138
You Want to Visit the UK? You Better Have a Google Play or App Store Account
New immigration rules for the UK are being enforced starting February 2026. This means citizens of 85 additional countries (including the USA and European countries) will need an Electronic Travel Authorisation (ETA) to visit, even for tourism. Luckily, you can apply (and pay) digitally. Unfortunately, the government…
2139
Jailbroken iOS can't run macOS apps – I spent a week to find out why (2021)
I ran command line macOS tools, such as Bash and Geekbench, on a jailbroken iPhone by replacing iOS’s dyld shared cache (all of iOS’s code) with macOS’s. However, graphical apps will never work: macOS’s WindowServer won’t start, since iOS’s drivers are too different.
2140
Stopping the smart TV from being used against you
Smart TVs are everywhere! But who is the master? Amid the electronics boom driven by A.I., one piece of electronics has remained almost unchanged financially. That is the digital display or flat-panel monitor. With good reason! The entire entertainment and streaming industry wants one of these devi
2141
How does Brown University know where you are?
In September 2020, Brown University accused students of lying about their location; e.g.:
2142
CVE-2026-31431: Copy Fail vs. rootless containers
In the previous post about SELinux MCS and GitLab runners, I briefly mentioned CVE-2026-31431 (“Copy Fail”) as a motivating example for per-job VM isolation. After that post went out I spent the weekend setting up a lab to actually run the exploit, trace it at the syscall level, and verify that the rootless Podman…
2143
2144
2145
The “Happy Path” to HTTPS
It's finally time: it's time the pendulum swings further towards the "secure by default" end of the scale than what it ever has before. At least insofar as securing web traffic goes because as of this week's Chrome 62's launch, any website with an input box
2146
Visiting a site that uses Disqus when not logged in sends URL to Facebook
I was surprised to see the Facebook SDK being loaded in the network tab on my blog when I don't have any Facebook buttons. It turned out to be coming courtesy of Disqus. No wonder Facebook knows everywhere you go!
2147
Spinning Up an Onion Mirror Is Stupid Easy
I recently spun up a .onion mirror of this website.
2148
Capital One attacker may have breached other major corporations
Federal prosecutors this week charged a Seattle woman with stealing data from more than 100 million credit applications made with Capital One Financial Corp . Incredibly, much of this breach played out publicly over several months on social media and other open online platforms. What follows is a closer look at the…
2149
WhatsApp and most alternatives share the same problem
Shall I migrate to Signal, Threema or Telegram? No, because they all have — WhatsApp included — the same problem: They are walled gardens. Imagine a world where for each mail recipient using a separate domain, I would need separate mail client? Or in other words: Gmail users can only communicate with Gmail users…
2150
Tor is not just for anonymity (2022)
Tech, Pets, and Vettes
2151
Web Scraping and Crawling Are Perfectly Legal, Right? (2017)
In this post, you'll find out more on the legal aspect of web scraping and crawling, and what possible consequences you might face.
2152
Black Hat Exploits of the Stupid-Easy 80s
I'm not saying there was no computer security in the 1980's but, wait... Yes. Yes I am.
2153
2154
2155
Go 1.20 Cryptography
A lot of new cryptography is landing in Go 1.20, including the new crypto/ecdh package and math/big-less RSA and ECDSA backends!
2156
Who Owns Your Wireless Service? Crooks Do
Incessantly annoying and fraudulent robocalls. Corrupt wireless company employees taking hundreds of thousands of dollars in bribes to unlock and hijack mobile phone service. Wireless providers selling real-time customer location data, despite repeated promises to the contrary. A noticeable uptick in SIM-swapping…
2157
The US Intelligence Community has a Third Leaker
Ever since the Intercept published this story about the US government’s Terrorist Screening Database, the press has been writing about a “second leaker”: The Intercept article focuses on the growth in U.S. government databases of known or suspected terrorist names during the Obama administration. The article cites…
2158
I discovered a critical exploit in ZeroMQ with mostly pure luck
Fang-Pen Lin's blog about programming
2159
Welp, there go my Git signatures
Hello! If you already know about the RoCA vulnerability, and you know what I did about it (or you don’t care), then feel free to skip down to the good stuff! Signs of Trouble Monday morning,…
2160
