2221
SSL certificate requirements are becoming obnoxious
SSL requirements are quickly becoming obnoxious.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,335 posts.
2222
2223
Spoofing the Samsung Smart TV Internet Check
So it looks like Samsung is offline this morning . This shouldn't bother me - I don't work for them and their network isn't my problem. However it turns out that my Samsung Smart TV thinks there's no internet if there's no www.samsung.com :( - using tcpdump I started looking at what the TV was trying to contact when I…
2224
The TSA's Selective Laptop Ban
Last Monday, the TSA announced a peculiar new security measure to take effect within 96 hours. Passengers flying into the US on foreign airlines from eight Muslim countries would be prohibited from carrying aboard any electronics larger than a smartphone. They would have to be checked and put into the cargo hold. And…
2225
2226
2227
Edward Snowden and Gen Y: a sign of leaks to come?
(Before I begin: there are participants in the discourse who would say that we're supposed to natter on about Edward Snowden , and not the contents of his disclosures, because turning it into a personal issue rather than a political one is useful to the machineries of state. But the point I'm about to make here is…
2228
Setting Up an Ad-Blocking VPN with WireGuard and Pihole
This guide will walk you through the setup of a remote machine that will act as a personal VPN server at the cost of 3 to 5 USD per month. We will also configure it to act as a DNS resolver that will automatically block spam, tracking, advertising and malware domains on all of your connected devices.
2229
Representing SHA-256 Hashes as Avatars
How to turn 256 bits of entropy into a beautiful, avatar-friendly circular SVG: the Hashvatar.
2230
Extracting content from an LCP “protected” ePub
As Cory Doctorow once said "Any time that someone puts a lock on something that belongs to you but won't give you the key, that lock's not there for you." But here's the thing with the LCP DRM scheme; they do give you the key! As I've written about previously, LCP mostly relies on the user entering their password (the…
2231
2232
How Dropbox hacks your mac
Update: also see Discovering how Dropbox hacks your mac If you have Dropbox installed, take a look at System Preferences > Security & Privacy > Accessibility tab (see …
2233
2234
2235
2236
2237
Why did the OpenSSL punycode vulnerability happen?
We look at how fuzzing should have caught the OpenSSL Punycode vulnerability, and why that code was even necessary in the first place.
2238
Ring0VBA – Getting Ring0 Using a Word Document
Hey hey! Welcome to my little corner of the internet. I am also known as 'Diz'! I made this site to document my research and contributions throughout the years, and other fun stuff I could come up with. Hope you're having a good day/afternoon/night wherever you are!
2239
Phishing domains tanked after Meta sued Freenom
The number of phishing websites tied to domain name registrar Freenom dropped precipitously in the months surrounding a recent lawsuit from social networking giant Meta , which alleged the free domain name provider has a long history of ignoring abuse complaints about phishing websites while monetizing traffic to…
2240
2241
Understanding the Worst .NET Vulnerability
In this post I discuss request smuggling, the recent vulnerability in ASP.NET Core with a severity score of 9.9, and how attackers could exploit it
2242
Some interesting malware I found
Update 6/28/22: a reader reached out to me and let me know that Malwarebytes now detects and removes this malware as Adware.Choprex and OSX.Generic.Suspicious - so if you're reading this because you are affected, go download Malwarebytes and run a full scan. Thanks Yegor!
2243
Attack of the week: FREAK (or 'factoring the NSA for fun and profit')
This is the story of how a handful of cryptographers ‘hacked’ the NSA. It’s also a story of encryption backdoors, and why they never quite work out the way you want them to. But I…
2244
FBI doesnt want you to know it uses NSLs to correlate identities you use online
Back in March, I parsed the declaration Nicholas Merrill submitted in his bid to reveal the contents of what he was asked to turn over via an NSL back in 2004. As a reminder, here’s what FBI permitted Merrill to reveal at the beginning of this suit. And here’s Merrill’s description of what kind of […]
2245
I'm not a fan of strlcpy(3)
strlcpy(3) is an OpenBSD function which is often hailed as a safer replacement for strcpy(3) and/or strncpy(3) . One of the obvious issues with strlcpy is that it's not safe if src isn't null-terminated. However, that's not the reason I don't like strlcpy. In fact despite knowing this, I used to think it was an okay…
2246
2247
2248
SolarWinds: What Hit Us Could Hit Others
New research into the malware that set the stage for the megabreach at IT vendor SolarWinds shows the perpetrators spent months inside the company’s software development labs honing their attack before inserting malicious code into updates that SolarWinds then shipped to thousands of customers. More worrisome, the…
2249
2250
Devirtualizing nike.com's bot protection
In this blog post, we'll examine the virtualization obfuscation used by Nike