1
Reverse engineering Ticketmaster's rotating barcodes
"Screenshots won't get you in", but Chrome DevTools will.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 279 posts.
2
Bypassing airport security via SQL injection
We discovered a serious vulnerability in the Known Crewmember (KCM) and Cockpit Access Security System (CASS) programs used by the Transportation Security Administration.
3
Thanks FedEx, this is why we keep getting phished
I've been getting a lot of those "your parcel couldn't be delivered" phishing attacks lately and if you're a human with a phone, you probably have been too. Just as a brief reminder, they look like this: These get through all the technical controls that exist at
4
Gaining access to anyones Arc browser without them even visiting a website
gaining access to anyones browser without them even visiting a website
5
Apple Photos phones home on iOS 18 and macOS 15
This morning while perusing the settings of a bunch of apps on my iPhone, I discovered a new setting for Photos that was enabled by default: Enhanced Visual Search. (I manually disabled it before taking the screenshot below.)
6
Jailbreaking RabbitOS
Critics unanimously agree that it sucks , and some have accused the company of deliberate deception . Rabbit Inc. reportedly accepts returns, but customers are so eager to get rid of their R1s that even new-in-box units are selling for well below RRP ($200) on secondary markets.
7
I pwned half of America's fast food chains simultaneously
How I pwned half of America’s fast food chains, simultaneously. Also checkout Eva’s blogpost of this event. With an upbeat pling my console alerted me that my script had finished running, to be precise it was searching for exposed Firebase credentials on any of the hundreds of recent AI startups. This was achieved…
8
Timeline of the xz open source attack
Over a period of over two years, an attacker using the name “Jia Tan” worked as a diligent, effective contributor to the xz compression library, eventually being granted commit access and maintainership. Using that access, they installed a very subtle, carefully hidden backdoor into liblzma, a part of xz that also…
9
Controlling the Taylor Swift Eras Tour wristbands with Flipper Zero
Many large concerts feature wristbands that light up on command. They are used to produce varied visual effects across a stadium. One compan...
10
Passkeys: A shattered dream
Firstyear's blog
11
The tiny chip that powers Montreal subway tickets
To use the Montreal subway (the Métro), you tap a paper ticket against the turnstile and it opens. The ticket works through a system called ...
12
Hacking 700M Electronic Arts accounts
(Ethically). Here's how I did it.
13
Hacking millions of modems and investigating who hacked my modem
Two years ago, something very strange happened to me while working from my home network. I was exploiting a blind XXE vulnerability that required an external HTTP server to smuggle out files, so I spun up an AWS box and ran a simple Python webserver to receive the traffic from the vulnerable server.
14
15
RFC 35140: HTTP Do-Not-Stab (2023)
Date: March 7, 2111
16
Google has another secret browser
another hidden browser which is accessible by a link
17
Can you get root with only a cigarette lighter?
Before you can write an exploit, you need a bug. When there are no bugs, we have to get creative—that's where Fault Injection comes in. Fault injection can take many forms, including software-controlled data corruption, power glitching, clock glitching, electromagnetic pulses, lasers, and more.
18
Hacking Kia: Remotely controlling cars with just a license plate
On June 11th, 2024, we discovered a set of vulnerabilities in Kia vehicles that allowed remote control over key functions using only a license plate. These attacks could be executed remotely on any hardware-equipped vehicle in about 30 seconds, regardless of whether it had an active Kia Connect subscription.
19
Perplexity AI is lying about their user agent
Perplexity AI claims it sends a user agent and respects robots.txt but it absolutely does not
20
CEO of data privacy company Onerep.com founded dozens of people-search firms
The data privacy company Onerep.com bills itself as a Virginia-based service for helping people remove their personal information from almost 200 people-search websites. However, an investigation into the history of onerep.com finds this company is operating out of Belarus and Cyprus, and that its founder has launched…
21
Instead of “auth”, we should say “permissions” and “login”
Most computer systems we interact with have an auth system of some kind. The problem is, that sentence is at best unclear and at worst nonsense. "Auth" can mean at least two things: authentication or authorization [1] . Which do we mean for an "auth system"? It's never perfectly clear and, unfortunately, we often mean…
22
The xz attack shell script
Andres Freund published the existence of the xz attack on 2024-03-29 to the public oss-security@openwall mailing list. The day before, he alerted Debian security and the (private) distros@openwall list. In his mail, he says that he dug into this after “observing a few odd symptoms around liblzma (part of the xz…
23
Is Telegram really an encrypted messaging app?
This blog is reserved for more serious things, and ordinarily I wouldn’t spend time on questions like the above. But much as I’d like to spend my time writing about exciting topics, som…
24
Cyber Security: A pre-war reality check
This is a lightly edited transcript of my presentation today at the ACCSS/NCSC/Surf seminar ‘Cyber Security and Society’. I want to thank the organizers for inviting me to their conference & giving me a great opportunity to talk about something I worry about a lot. Here are the original slides with notes, which may be…
25
Bypassing regulatory locks, hacking AirPods and Faraday cages
How we bypassed Apple's regulatory restrictions, built a Faraday cage and enabled georestricted features on the Airpods Pro 2 for our grandparents.
26
Inside the "3 billion people" national public data breach
I decided to write this post because there's no concise way to explain the nuances of what's being described as one of the largest data breaches ever. Usually, it's easy to articulate a data breach; a service people provide their information to had someone snag it through
27
Multiple new macOS sandbox escape vulnerabilities
This is a blog post for my presentation at the conference POC2024. The slides are uploaded here.
28
Breaking the 4Chan CAPTCHA
In this blog post, I will talk about my successful experiment in machine learning using TensorFlow to automate solving the 4Chan CAPTCHA.
29
Should I use JWTs for authentication tokens?
Let’s talk about what we’re talking about. JWT stands for JSON Web Tokens, a reasonably well defined standard for authenticated tokens. Specifically they have a header with format information, a payload, and a signature or message authentication code. The core idea is that whoever has the corresponding verification…
30
900 Sites, 125M accounts, 1 Vulnerability
900 Sites, 125 million accounts, 1 vulnerability