Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,768 posts.
Two years ago, something very strange happened to me while working from my home network. I was exploiting a blind XXE vulnerability that required an external HTTP server to smuggle out files, so I spun up an AWS box and ran a simple Python webserver to receive the traffic from the vulnerable server.
In iOS 26.3, Apple introduced a new privacy feature which limits “precise location” data made available to cellular networks via cell towers. The feature is only available to devices with Apple’s in-house modem introduced in 2025. The announcement1 says https://support.apple.com/en-us/126101 ↩
I know a number of folks use The Great Suspender to automatically suspend inactive browser tabs in Chrome. Apparently recent versions of this extension have been taken over by a shady anonymous entity and is now flagged by Microsoft as malware . Notably the most recent version of the extension (v7.1.8) has added…
The common pattern of trying to delete yourself.
The new Chinese owner of the popular Polyfill JS project injects malware into more than 100 thousand sites.
This has been a very long time coming, but finally, after a marathon effort, the brand new Have I Been Pwned website is now live! Feb last year is when I made the first commit to the public repo for the rebranded service, and we soft-launched the new brand
Updated: March 4, 2025
Some people enter the technology industry to build newer, more exciting kinds of technology as quickly as possible. My keynote will savage these people and will burn important professional bridges, likely forcing me to join a monastery or another penance-focused organization. In my keynote, I will explain why the…
Updated Aug. 28, 2024. Take back your privacy Firefox is rolling out Total Cookie Protection by default to more Firefox users worldwide, making Firefox the
In July, we shared our views about the need for government regulation and responsible industry measures to address advancing facial recognition technology. As we discussed, this technology brings important and even exciting societal benefits but also the potential for abuse. We noted the need for broader study and…
I regularly search for vulnerabilities on big services that allow it and have a Bug Bounty program. Here is my first paper which covers a vulnerability I discovered on one of Facebook’s servers.
What computer do you use? Who made it? Have you ever thought about what came with your computer? When we think of Remote Code Execution (RCE) vulnerabilities in mass, we might think of vulnerabilities in the operating system, but another attack vector to consider is "What third-party software came with
In the summer of 2022, KrebsOnSecurity documented the plight of several readers who had their accounts at big-three consumer credit reporting bureau Experian hijacked after identity thieves simply re-registered the accounts using a different email address. Sixteen months later, Experian clearly has not addressed this…
A couple of weeks ago I went to the local shopping centre looking for a thermometer. After entering one store upon leaving without buying anything a tracker was assigned to me. I didn’t think much of it at first, but he followed me dutifully around the shopping centre, took careful note of how I walked. Whenever I…
Found 99 vulnerabilities (84 moderately irrelevant, 15 highly irrelevant)
Yuebin Sun(@yuebinsun2020) of Tencent Security Xuanwu Lab 0x0 SummaryToday, Adobe Acrobat Reader DC for macOS patched three critical vulnerabilities(CVE-2020-9615, CVE-2020-9614, CVE-2020-9613) I repo
Claude Cowork is vulnerable to file exfiltration attacks via indirect prompt injection as a result of known-but-unresolved isolation flaws in Claude's code execution environment.
I work with U.S. law firms as a non-testifying technical consulting expert on matters involving the Apple platform and iOS apps. Learn more about my litigation consulting.
I extracted the certificate from the SuperFish adware and cracked the password (" komodia ") that encrypted it. I discuss how down below. T...
When discussing scams and social engineering attacks, it's easy for security experts to imply the victims of these attacks should have known better. And, as much as we may like to think we'd handle these situations so much better, that's just not true.
Bug Bounty Hunting from Pentest View, and How to Find Remote Code Execution and Someone's Backdoor on Facebook Server...
In another week the GDPR , or the General Data Protection Regulation will become enforceable and it appears that unlike any other law to date this particular one has the interesting side effect of causing mass hysteria in the otherwise rational tech sector.
Reverse engineering reveals how Paint and Photos embed a server-issued GUID into the pixels of locally generated AI images.
