1
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 204 posts.
2
How I hacked Github again
This is a story about 5 Low-Severity bugs I pulled together to create a simple but high severity exploit, giving me access to private reposi...
3
Today I Briefed Congress on the NSA
This morning, I spent an hour in a closed room with six members of Congress: Rep. Lofgren, Rep. Sensenbrenner, Rep. Bobby Scott, Rep. Goodlatte, Rep. Mike Thompson, and Rep. Amash. No staffers, no public: just them. Lofgren had asked me to brief her and a few Representatives on the NSA. She said that the NSA wasn’t…
4
One of the Most Alarming Internet Proposals I've Seen
Previous: Warning: Network Solutions' Moronic Alert Email That Masquerades as a Phishing Attack
5
Everything you need to know about the Shellshock Bash bug
This content is now available in the Pluralsight course "Understanding the Shellshock Bash Bug" [http://www.pluralsight.com/courses/shellshock-bash-bug]Remember Heartbleed [https://www.troyhunt.com/2014/04/everything-you-need-to-know-about.html]? If you believe the hype today, Shellshock is in that league and with
6
How I reverse-engineered Google Docs to play back any document's keystrokes
How James Somers reverse-engineered Google Docs to play back any document's keystrokes
7
NBC Story about Hacking at Sochi is 100% Fraudulent
Yesterday (Feb 5 2014) On February 4th, NBC News ran a story claiming that if you bring your mobile phone or laptop to the Sochi Olympics...
8
9
FFS SSL
wingolog: article: ffs ssl
10
Pulling JPEGs out of thin air
This is an interesting demonstration of the capabilities of afl ; I was actually pretty surprised that it worked! $ mkdir in_dir $ echo ' h...
11
12
Apple Confirms “Back Doors”, Downplays Their Severity
Apple responded to allegations of hidden services running on iOS devices with this knowledge base article . In it, they outlined three of the big services that I outlined in my talk. So again, Apple has, in a traditional sense, admitted to having backdoors on the device specifically for their own use.
13
Apple's SSL/TLS bug
Yesterday, Apple pushed a rather spooky security update for iOS that suggested that something was horribly wrong with SSL/TLS in iOS but gave no details. Since the answer is at the top of the Hacker News thread, I guess the cat's out of the bag already and we're into the misinformation-quashing stage now.
14
“Invalid username or password” is a useless security measure
Login attempts fail because computer users can't remember their email or didn't input the right password. Most websites on the Internet won't tell you which one is actually incorrect.
15
16
17
18
Don't run 'strings' on untrusted files
Many shell users, and certainly most of the people working in computer forensics or other fields of information security, have a habit of ru...
19
How I bypassed 2-Factor-Authentication on Google, Facebook, Yahoo, LinkedIn
I remember fondly two years ago, when 2-Factor-Authentication (2FA) became popular and well used across major web applications (Google, Facebook, Yahoo and others). I found, my naive sixteen year old self unable to come to terms for why the genius idea had not been thought of before. At
20
Why the Sony hack is unlikely to be the work of North Korea
Everyone seems to be eager to pin the blame for the Sony hack on North Korea. However, I think it’s unlikely. Here’s why:1. The broken English looks deliberately bad and doesn’t e…
21
All cameras are police cameras
Welcome to The Nor, a series of essays by James Bridle commissioned by the Hayward Gallery in 2014/5. In order, the essays are: All Cameras Are Police Cameras , Living in the Electromagnetic Spectrum , and Low Latency , as well as an Epilogue . These are accompanied by photographs and a map , and additional content…
22
23
Downloading Software Safely Is Nearly Impossible
Let’s say you have a brand-new Windows laptop and you’re just oh, so happy. You’re pretty sure the NSA did not interdict it during shipment , and thus that it comes only with the flaky goatware Microsoft, Lenovo, and any number of Lenovo’s business partners intended for it to have. Now all you need is an SSH client so…
24
25
26
Cookie Bomb or Let's Break the Internet
TL;DR I can craft a page "polluting" CDNs, blogging platforms and other major networks with my cookies. Your browser will keep sendin...
27
True Goodbye: ‘Using TrueCrypt Is Not Secure’
The anonymous developers responsible for building and maintaining the free whole-disk encryption suite TrueCrypt apparently threw in the towel this week, shuttering the TrueCrypt site and warning users that the product is no longer secure now that Microsoft has ended support for Windows XP .
28
29
30
