3901
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,770 posts.
3902
Running Unsupported iOS on Deprecated Devices
Earlier this year I demoed iOS 6 running on an iPod touch 3 - a device that Apple never gave iOS 6 to, making iOS 5.1.1 the latest build it can run
3903
Reverse engineering Xiaomi air purifier NFC stickers
For a very thorough write-up on how this all works , please visit : https://unethical.info/2024/01/24/hacking-my-air-purifier/
3904
Progress Towards 100% HTTPS, June 2016
Our goal with Let’s Encrypt is to get the Web to 100% HTTPS. We’d like to give a quick progress update. Let’s Encrypt has issued more than 5 million certificates in total since we launched to the general public on December 3, 2015. Approximately 3.8 million of those are active, meaning unexpired and unrevoked. Our…
3905
Popular iPhone and iPad Apps Snooping on the Pasteboard
This article provides an investigation of some popular apps that frequently access the pasteboard without user consent. These apps range from popular games and social networking apps, to news apps of major news organizations. We found that many apps quietly read any text found in the pasteboard every time the app is…
3906
Photon-Emission-Guided Laser Fault Injection Enables RP2350 Secure Debug
Differential photon-emission microscopy localized debug enable register activity and narrowed the laser search before SWD-guided injection set the two bits required to restore Secure debug on an RP2350 A4.
3907
iOS 10: Security Weakness Discovered, Backup Passwords Much Easier to Break
We discovered a major security flaw in the iOS 10 backup protection mechanism. This security flaw allowed us developing a new attack that is able to bypass cert
3908
How Obama’s BlackBerry got secured (2013)
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
3909
Remote Code Execution Found in CocoaPods
tl;dr CocoaPods is a popular package manager used by lots of iOS apps (among other Swift and Objective-C Cocoa applications). I found a remote code execution...
3910
A High-Level Technical Overview of Homomorphic Encryption
About two years ago, I switched teams at Google to focus on fully homomorphic encryption (abbreviated FHE, or sometimes HE). Since then I’ve got to work on a lot of interesting projects, learning along the way about post-quantum cryptography, compiler design, and the ins and outs of fully homomorphic encryption. If…
3911
Iraq Blocks Telegram, Leaks Blackhole BGP Routes
This past weekend, the government of Iraq blocked the popular messaging app Telegram, citing the need to protect Iraqi’s personal data. However, when an Iraqi government network leaked out a BGP hijack used for the block, it became yet another BGP incident that was both intentional, but also accidental. Thankfully…
3912
Mexican Protest Site Censored by GoDaddy with the U.S. Embassy's Help
The Mexican website 1dmx.org (mirror here), was set up in the wake of a set of controversial December 1st 2012 protests against the inauguration of the new President of Mexico, Enrique Peña Nieto. For a year, the site served as a source of information, news, discussion and commentary from the point...
3913
3914
Why CVE-2022-3602 was not detected by fuzz testing
So recently a very hyped memory corruption security vulnerability was discovered in the OpenSSL punycode parser. Some folks including Hanno ...
3915
3916
Feedly gets hit by DDoS attack, refuses to give in to blackmail
Feedly reports that it is suffering from a denial-of-service attack that could impact users’ ability to catch up with the latest updates from their favourite websites.
3917
3918
The God Login
I graduated with a Computer Science minor from the University of Virginia in 1992. The reason it’s a minor and not a major is because to major in CS at UVa you had to go through the Engineering School, and I was absolutely not cut out for that kind
3919
Nobody expects CDATA sections in XML
I made a very explicit, pragmatic design decision with afl-fuzz : for performance and reliability reasons, I did not want to get into stati...
3920
How Purism avoids Intel’s Active Management Technology
With recent chipsets, Intel offers a mechanism called Active Management Technology (Intel AMT, part of the “vPro”* featureset, specifically the Intel Management Engine) which, Intel says,“allows IT or managed service providers to better discover, repair, and protect their networked computing assets”. This means…
3921
You cannot have a digital copy of the DC Code
On how the law was taken away from the people of Washington, DC by legal shenanigans
3922
Hardening cellular basebands in Android
Posted by Ivan Lozano and Roger Piqueras Jover Android’s defense-in-depth strategy applies not only to the Android OS running on the Appl...
3923
The Safety Boat: Kubernetes and Rust
Our team, DeisLabs , recently released a new piece of software called Krustlet , which is a tool for running WebAssembly modules on the popular, open-source container management tool called Kubernetes . Kubernetes is used quite extensively to run cloud software across many vendors and companies and is primarily…
3924
Smuggling USB Sticks
"This Is Not A Film" by Iranian director Jafar Panahi, who is under house arrest in his country for alleged “propaganda against the regime,” will be screened under the Free Jafar Panahi Program of the 13th Cinemanila. The film was smuggled from Iran in a Flash-Drive hidden inside a cake to Cannes for screening a few…
3925
SMS phishers harvested phone numbers, shipment data from UPS tracking tool
The United Parcel Service (UPS) says fraudsters have been harvesting phone numbers and other information from its online shipment tracking tool in Canada to send highly targeted SMS phishing (a.k.a. “smishing”) messages that spoofed UPS and other top brands. The missives addressed recipients by name, included details…
3926
Private spies hired by FBI and corporations infiltrate Discord, Reddit, WhatsApp
Leading “threat intelligence” firms are creating fake online personas to gain access to every corner of the web.
3927
We found critical vulnerabilities in Hive Social
Dieser Artikel ist auch auf deutsch erschienen. Update: The vulnerabilities are currently no longer exploitable because Hive deactivated their servers. More details Following the Twitter takeover, a number of services promising to be an alternative gained traction. One of those is “Hive Social”, which reached more…
3928
Technical Details Behind a 400Gbps NTP Amplification DDoS Attack
On Monday we mitigated a large DDoS that targeted one of our customers. The attack peaked just shy of 400Gbps. We've seen a handful of other attacks at this scale, but this is the largest attack we've seen that uses NTP amplification.
3929
Phishing with Linkedin's Intro
Security and Programming Blog
3930
Why I’m not speaking at CPDP: It’s the privacy-washing
13 Jan, 2016 The sponsorship of privacy and human rights conferences by corporations that erode our privacy and human rights is a clear conflict of interests that we must challenge. The revolution will not be sponsored by those we are revolting against.