2941
Keybase iOS Has a Backdoor?
Keybase’s iOS client has received a backdoor. It seems that Stellar, the extremely well-funded and well-marketed cryptocurrency, has struck a deal with Keybase…
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,335 posts.
2942
When root meets immutable: OpenBSD chflags vs. log tampering
Rafael Sadowski
2943
2944
The Karma connection in Chrome Web Store
A bunch of malicious extensions in Chrome Web Store have hidden affiliate fraud functionality, collect users’ browsing profiles, or both. These extensions appear to be connected to the Karma shopping assistant, developed by Karma Shopping Ltd. which is not a small company.
2945
2946
2947
Sourcehut account takeover via build logs (XSS in ansi2html)
A wormable vulnerability allowed anyone able to inject text in a build log on builds.sr.ht (or other instances) to take over accounts who viewed them
2948
2949
Safe from what?
What does it mean for a baby monitor to be safe? Some things are clearly essential: It should not explode; it should not release significant quantities of dangerous gasses; if it's designed to be placed within reach of a baby, it should not pose an electrocution or choking hazard. Less obviously, if it has data or…
2950
2951
Scammers registering date-based domain names
Yesterday, January 2nd, my wife received a billing alert from her phone provider. Luckily, she's not with EE - because it's a pretty convincing text. That domain name is specifically designed to include the day's date. If you're stood up on a crowded train, with your phone screen cracked, would you notice that a . is…
2952
Hashing is not encryption
Encryption, encoding, and hashing are three related but distinct concepts. It’s important for you to understand all three.
2953
Attacking the DeFi ecosystem with flash loans for fun and profit (2020)
This article will examine in details what happened during the two transactions that exploited vulnerabilities to open under-collateralized positions in bZx, causing a loss of equity worth more than a million dollar in total.
2954
Lifetimes of cryptographic hash functions
Quick summary of my recommendations on compare-by-hash: If you are using compare-by-hash to generate addresses for data that can be supplied by malicious users, you should have a plan to migrate to a new hash every few years. For example, BitTorrent falls into this category, but rsync doesn't. Keep in mind that new…
2955
2956
'Zero trust’ security is a poor choice of words
Consider the user's perspective when naming a security initiative
2957
Cybersecurity and the curse of binary thinking
Working in information/cybersecurity and technology risk is a fascinating and challenging career, as I’ve covered here. There is, mostly, a great spirit of sharing and collaboration among security professionals. However, I’ve observed one disturbing and growing trend in the past few years that might be characterized…
2958
2959
The NSA Is Hoarding Vulnerabilities
The National Security Agency is lying to us. We know that because data stolen from an NSA server was dumped on the Internet. The agency is hoarding information about security vulnerabilities in the products you use, because it wants to use it to hack others’ computers. Those vulnerabilities aren’t being reported, and…
2960
2961
A large collection of fraudulent web stores
It started simply enough...
2962
2963
I revoked $1M worth of EV certificates
Personal like or dislike of EV aside for a moment, we can all agree on what the name of EV certs implies. Organisations get their company details in the certificate and CAs have to do some extended validation of that data compared to a normal certificate. Turns out, that doesn'
2964
2965
Hacking a cheap fitness tracker bracelet
A blog post on reverse engineering and customizing the firmware of a cheap fitness tracker bracelet.
2966
Unraveling NSA's TURBULENCE Programs
The NSA TURBULENCE program was first revealed in 2007 by the Baltimore Sun for being over-budget and poorly-managed 1 2 . Many documents from the Snowden trove from the past two years reference parts of this program, but no coherent story or overview of how these programs operate together has been described. This is…
2967
2968
2969
NY Man Pleads Guilty in $20M SIM Swap Theft
A 24-year-old New York man who bragged about helping to steal more than $20 million worth of cryptocurrency from a technology executive has pleaded guilty to conspiracy to commit wire fraud. Nicholas Truglia was part of a group alleged to have stolen more than $100 million from cryptocurrency investors using…
2970
Think You’ve Got Your Credit Freezes Covered? Think Again
I spent a few days last week speaking at and attending a conference on responding to identity theft. The forum was held in Florida, one of the major epicenters for identity fraud complaints in United States. One gripe I heard from several presenters was that identity thieves increasingly are finding ways to open new…