2551
It's School time: Adventures in hacking an old Kindle
Jailbreaking an old Kindle and turning it into a school dashboard using Cloudflare Workers, Puppeteer, and image processing.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,335 posts.
2552
Isaac Asimov on Security Theatre.
A great find: In his 1956 short story, “Let’s Get Together,” Isaac Asimov describes security measures proposed to counter a terrorist threat: “Consider further that this news will leak out as more and more people become involved in our countermeasures and more and more people begin to guess what we’re doing. Then…
2553
2554
CSS Based Attack fontface
In this post, I would like to share about new CSS based attack with unicode-range descriptor of @font-face rule . Using this technique, an...
2555
Using YouTube to steal your files
A writeup of my $4133.70 Google Drive vulnerability chain.
2556
Put an io_uring on it – Exploiting the Linux Kernel (2022)
Put an io_uring on it - Exploiting the Linux Kernel - chompie at the bits
2557
Reverse Engineering a Docker Image
This started with a consulting snafu: Government organisation A got government organisation B to develop a web application. Government organisation B subcontracted part of the work to somebody. Hosting and maintenance of the project was later contracted out to a private-sector company C. Company C discovered that the…
2558
TeleMessage Customers Include DC Police, Andreessen Horowitz, JP Morgan,Hundreds
💡Update May 26, 2025: I've published the source code for TeleMessage Explorer: a new open source research tool I've been digging through the 410 GB of Java heap dumps from TeleMessage's archive server, provided by DDoSecrets. Here's a description of the dataset, some of my initial
2559
2560
Did the Clinton Email Server Have an Internet-Based Printer?
The Associated Press today points to a remarkable footnote in a recent State Department inspector general report on the Hillary Clinton email scandal: The mail was managed from the vanity domain “ clintonemail.com .” But here’s a potentially more explosive finding: A review of the historic domain registration records…
2561
Stop Breaking TLS
Rant ahead: I hate TLS “Inspection” software with a burning passion and I wish we collectively as an industry would just knock it the fuck off and stop pretending it’s some great security benefit. Every time I encounter it, in whatever form, it’s a gigantic headache that makes everyone’s life worse off and as far as I…
2562
2563
Bypassing Browser Security Warnings with Pseudo Password Fields
It seems that there is no limit to human ingenuity when it comes to working around limitations within one's environment. For example, imagine you genuinely wanted to run a device requiring mains power in the centre of your inflatable pool - you're flat out of luck, right? Wrong! Or
2564
How do you know when macOS detects and remediates malware?
macOS may alert you when you’re trying to open or run a file, with an alert informing you that malware was detected. But what about in scans?
2565
If malware authors ever learn how to spell we're all screwed
Forgive the lousy screenshot and transparency in the title bar, but I just got ...
2566
2567
2568
2569
Mac OS High Sierra automatically checks EFI firmware each week
Every week, Macs running High Sierra will check the integrity of their EFI firmware, in a bid to detect tampering by malware.
2570
2571
Vendors, Disclosure, and a bit of WebUSB Madness
Update 2018-06-19: Yubico updated their statement on 2018-06-18, apologizing and crediting us: https://twitter.com/Yubico/status/1008816076610625536
2572
Pwncloud – Bad crypto in the Owncloud encryption module
This blog is written by Hanno Böck. Unless noted otherwise, its content is licensed as CC0 .
2573
I Found Malware in a BeamNG Mod
An analysis using Process Monitor and WinDbg, dealing with JavaScript, WASM, and Windows shellcode.
2574
Dual_EC_DRBG backdoor: a proof of concept
Dual_EC_DRBG is an pseudo-random number generator promoted by NIST in NIST SP 800-90A and created by NSA. This algorithm is problematic because it has been made mandatory by the FIPS norm (and should be implemented in every FIPS approved software) and some vendors even promoted this algorithm as first source of…
2575
Can a Tarot card reading be defamatory?
Crazed Tik-Toker's Tirade Against University Professor Raises Fact v. Opinion Issue
2576
It’s time to stop using SMS for security
By now most infosec professionals are aware of various ways SMS text messaging can be hijacked. For example so-called “SIM Swap” attacks…
2577
I'm blocking connections from AWS to my on-prem services
The direct result of bulletproof infrastructure / cloud providers which are "too big to fail" is the balkanized internet . I don't think this has fully come to pass, but it might be starting to happen or might come to pass soon.
2578
Unix shells are generally not viable access control mechanisms any more
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
2579
2580